NetSec-Analyst Practice Test 22 — 15 Questions

Question 1

What information can you see in the object list view in SCM? (Choose THREE)

Accepted Answer

Object Type. In the SCM (Strata Cloud Manager) object list view, each row displays the Object Type (option B), such as Address, Address Group, Service, or Application, so administrators can identify what kind of object they are managing. The Object Name (option C) is also shown, giving the unique identifier of each object for quick reference and selection. Assigned Tags (option E) appear in the list as well, allowing tag-based filtering and organization of objects across the tenant. Real-time traffic volume (option A) is not part of the object list view; that data belongs to monitoring or dashboard views, not object management. User password (option D) is never displayed in an object list, since credentials are not stored or shown as object attributes in SCM.

Answer

Real-time traffic volume

Answer

User password

Question 2

An administrator wants to permit traffic based on a specific User-ID group. Where should this group be referenced in the Security Policy?

Accepted Answer

Source User. The 'Source User' field in the security policy is where groups are added to permit/deny traffic.

Answer

Application

Answer

Service

Answer

Destination Address

Question 3

A security administrator is configuring a new firewall to integrate with an external LDAP server for user authentication. The administrator needs to ensure that user groups are correctly mapped for policy enforcement. Which TWO actions must be performed to enable group mapping? (Choose two.)

Accepted Answer

Create a group mapping profile that specifies the group object class and attributes.. To enable group mapping from an LDAP server, two key actions are required: configuring an LDAP server profile with the correct base DN and bind credentials, and creating a group mapping profile that specifies the group object class and attributes. These steps allow the firewall to query the LDAP directory and retrieve group membership information, which can then be used in security policies. Without both, group mapping will not function correctly.

Answer

Set up a syslog server to receive User-ID logs.

Answer

Enable User-ID on the zone where users are located.

Answer

Configure a RADIUS server for authentication.

Question 4

A security analyst is reviewing an existing Address Group that contains several Address Objects. The analyst needs to add a new server to the group so that it inherits the same policy permissions as the other members. What is the most efficient way to accomplish this in SCM?

Accepted Answer

Add the new server's Address Object as a member of the existing Address Group.. Address Groups are designed to simplify policy management by allowing multiple Address Objects to be referenced as a single entity. Adding the new server's Address Object to the existing group automatically grants it the same policy permissions because the rule already references the group. This avoids rule duplication and keeps the configuration clean and scalable.

Answer

Modify the existing Security Policy rule to include the new server's IP address directly in the source field.

Answer

Clone the existing Address Group and add the new server to the clone, then update the policy rule to use the clone.

Answer

Create a new Security Policy rule specifically for the new server and place it above the existing rule.

Question 5

An administrator wants to verify that a specific Threat Prevention profile is applied to a security rule. Where is the most accurate place to check this?

Accepted Answer

Policies > Security > [Rule] > Actions. Within the Security Policy rule definitions, each rule has a dedicated 'Actions' tab where the Profile Group or specific profile is mapped.

Answer

Objects > Security Profiles

Answer

Monitor > Threat

Answer

Device > Setup

Question 6

A network security analyst is troubleshooting connectivity issues between two internal subnets separated by a firewall. The analyst suspects that the firewall is dropping packets due to a security policy rule. Which CLI command should the analyst use to view the real-time packet drop counters for the firewall's dataplane?

Accepted Answer

show counter global filter delta yes. The 'show counter global filter delta yes' command is specifically designed to show changes in global counters, including packet drops, in real time. By using the delta option, the analyst can observe which drop counters are incrementing during the connectivity issue, quickly identifying the cause. Other commands either show static totals or lack the necessary drop detail, making them less effective for this troubleshooting scenario.

Answer

show interface all

Answer

show running global-counter

Answer

show session all

Question 7

Which TWO items can be managed or configured within the Device > Setup > Services tab?

Accepted Answer

DNS server settings.. In the Palo Alto Networks firewall GUI, Device > Setup > Services is where you configure the services the management plane uses, including DNS server settings (option B) and NTP server configuration (option C); these fields let the firewall resolve hostnames and synchronize its clock with external time sources. Both are explicitly located under the Services section of the Setup tab, making them the two correct answers. GlobalProtect portal settings (option A) are configured under Network > GlobalProtect > Portals, not under Device > Setup > Services. Interface MTU settings (option D) belong to the interface configuration under Network > Interfaces (or via the interface's Advanced tab), and security policy rules (option E) are managed under Policies > Security, so neither appears in Device > Setup > Services.

Answer

GlobalProtect portal settings.

Answer

Interface MTU settings.

Answer

Security policy rules.

Question 8

An engineer is creating a new Security Policy rule in Strata Cloud Manager that must allow outbound traffic only to a specific external SaaS provider whose IP ranges change frequently. The provider publishes a public HTTPS feed of its current IP ranges. The engineer wants the rule to automatically stay current without manual edits. Which object configuration best meets this requirement?

Accepted Answer

Create an External Dynamic List (EDL) pointing to the provider's HTTPS feed and reference it as the destination in the rule.. An External Dynamic List is the correct configuration because it pulls the provider's published IP ranges from an HTTPS feed on a refresh schedule and can be referenced directly as the destination in a Security Policy rule. This keeps the rule aligned with the provider's current ranges automatically, eliminating the manual updates and staleness that a static object would introduce.

Answer

Create a Dynamic Address Group with a filter matching tags applied to the provider's IP addresses.

Answer

Create a Service object referencing the provider's domain and use it as the destination in the rule.

Answer

Create a static Address Object containing the provider's current IP ranges and update it manually each quarter.

Question 9

A security analyst is reviewing the firewall's operational logs and notices that the firewall is not sending SNMP traps to the monitoring server. The analyst verifies that the SNMP community string is correct and the server is reachable. Which TWO additional configurations should the analyst check on the firewall? (Choose two.)

Accepted Answer

SNMP Trap Profile settings. The two additional configurations to check are the SNMP Trap Destination settings and the SNMP Trap Profile settings. The Trap Destination defines where traps are sent, and the Trap Profile defines which traps are generated. If either is missing or incorrect, traps will not be received by the monitoring server. The other options are less relevant: Log Forwarding profiles do not handle SNMP traps, SNMPv3 credentials are only needed for SNMPv3, and the management IP is not the primary cause.

Answer

Log Forwarding profile for SNMP

Answer

SNMPv3 user credentials

Answer

Firewall's management interface IP address

Question 10

A security analyst is drafting a policy that defines how the organization classifies data and who may access each class. Which document type is the analyst creating?

Accepted Answer

A data classification and handling policy. The activity described is defining data sensitivity classes and the access rules for each, which is the purpose of a data classification and handling policy. Incident response, business continuity, and acceptable use documents serve different governance functions and do not establish classification schemes or class-based access entitlements.

Answer

A business continuity plan

Answer

An incident response plan

Answer

An acceptable use policy

Question 11

A network security administrator needs to give a junior analyst read-only visibility into traffic logs and threat logs on a production Palo Alto Networks firewall, but must ensure the analyst cannot change any configuration. Which built-in administrator role should be assigned?

Accepted Answer

read-only. The read-only administrative role provides exactly the monitoring visibility the analyst needs while blocking configuration changes. Roles such as superuser and deviceadmin grant write access that violates least privilege, and auditadmin does not expose traffic or threat logs. Assigning read-only keeps the production firewall protected while enabling investigation.

Answer

auditadmin

Answer

deviceadmin

Answer

superuser

Question 12

An analyst is creating a new Security Policy rule and needs to reference a service that uses TCP port 8443. No such service object exists yet. What is the most efficient way to proceed while staying within the policy rule creation workflow?

Accepted Answer

Use the inline object creation feature in the policy rule to define the new service object on the fly.. The most efficient approach is to use the inline object creation capability available directly within the policy rule editor. This allows the analyst to define the new service object for TCP port 8443 without leaving the rule configuration screen. Creating the object separately or modifying an existing one introduces unnecessary steps or risk.

Answer

Create a custom application object for port 8443 and reference it in the rule.

Answer

Modify an existing service object to include port 8443, then use that object.

Answer

Create the service object from the Objects tab, then return to the policy rule and select it.

Question 13

Which feature allows you to group multiple Address Objects together to simplify Security Policy management?

Accepted Answer

Address Group. Address Groups allow administrators to bundle multiple individual address objects into a single logical entity.

Answer

Tagging

Answer

Address Object Registry

Answer

Snippet

Question 14

Which menu path in the NGFW GUI allows an administrator to view the status of all active security subscriptions?

Accepted Answer

Device > Licenses. The Device > Licenses page provides a comprehensive view of all active subscriptions, their expiration dates, and activation status.

Answer

Device > Setup > Management

Answer

Policies > Security > Subscriptions

Answer

Network > Interfaces > Global

Question 15

An analyst is reviewing a firewall policy that permits outbound traffic from the Trust zone to the Untrust zone using the application 'web-browsing'. During an incident, the analyst notices that an internal host is accessing an external site over TCP port 8080, but the firewall logs show the session as 'web-browsing' and allows it. Which mechanism is responsible for this behavior?

Accepted Answer

The firewall uses App-ID to identify the application based on its protocol characteristics, regardless of the port number.. App-ID decouples application enforcement from port numbers, so a policy permitting web-browsing will allow that application on any port, including 8080. The firewall identifies the application by inspecting the session, not by assuming the port. This is why the session is logged as web-browsing and permitted, even though the port is non-standard.

Answer

The firewall uses the SSL decryption policy to identify the application, and decryption automatically permits the traffic.

Answer

The firewall falls back to port-based rule matching when the application is unknown, and port 8080 is implicitly allowed.

Answer

The firewall uses the service object 'service-http' which includes port 8080 by default.