NetSec-Analyst Practice Test 23 — 15 Questions

Question 1

While building a Security Policy rule, an analyst realizes the destination address object does not exist yet. The analyst wants to create it without leaving the rule configuration workflow in SCM. What is the most efficient approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the inline create option in the destination address field to define the new Address object on the spot.. SCM's policy editor supports inline object creation, letting the analyst define the missing Address object from the destination field itself. The object is persisted and selected immediately, avoiding placeholders, bulk imports, or cloning detours. This streamlines rule authoring and keeps the configuration consistent, which is why it is the most efficient option for the described situation.

Answer

Import a CSV of address objects into SCM and then reload the policy editor to select the new entry.

Answer

Save the policy rule with a placeholder address, then create the object from the Objects page and edit the rule afterward.

Answer

Clone an existing similar Address object from the object list and then return to the rule to select it.

Question 2

A security administrator needs to ensure that the firewall's configuration is backed up automatically every day and stored on an external server. The administrator wants to use the firewall's built-in capabilities without installing additional software. Which method should the administrator use?

Accepted Answer

Configure a scheduled configuration backup in Device > Setup > Operations. The firewall has a built-in scheduled configuration backup feature under Device > Setup > Operations. This allows administrators to define a schedule and specify an external server (SCP or FTP) to store the backups. The other options either require manual intervention, additional scripting, or misinterpret Panorama's capabilities. Thus, the scheduled backup in Device > Setup > Operations is the correct choice.

Answer

Schedule a configuration export via the firewall's Web UI

Answer

Use the firewall's XML API to schedule a daily configuration backup

Answer

Configure a scheduled job in Panorama to push configuration to the firewall

Question 3

A security analyst is configuring a rule to allow access to a web server that is part of a load-balanced pool. The server's IP address changes frequently due to autoscaling, but its DNS name remains constant. The analyst wants the rule to automatically adapt to IP changes without manual updates. Which object type should be used?

Accepted Answer

FQDN object. The FQDN object is designed to resolve a domain name to IP addresses and periodically refresh that resolution. This makes it the correct choice when the server's IP changes but its DNS name remains constant, as in autoscaling or load-balanced environments. Other object types either require manual updates or rely on tagging mechanisms that may not be present.

Answer

Static Address object

Answer

Dynamic Address Group

Answer

IP Range object

Question 4

Which THREE factors can impact the performance of a firewall during a log-intensive period?

Accepted Answer

Congested log forwarding network.. Option A is correct because when the log forwarding network is congested, the firewall cannot reliably transmit logs to its syslog or log-collection destination, causing buffering, dropped logs, and backpressure that degrades firewall performance during log-intensive periods. Option C is correct because a high volume of log generation directly increases CPU, memory, and I/O load on the firewall as it formats, buffers, and writes each log entry, which is the core driver of performance impact in a log-intensive period. Option D is correct because management plane resource exhaustion—such as saturated CPU, memory, or disk on the management plane handling logging, syslog, and management processes—can slow or stall log processing and even affect overall firewall responsiveness. Option B is not correct because chassis color is purely cosmetic and has no effect on firewall performance. Option E is not correct because the type of Ethernet cable does not meaningfully impact firewall performance during log-intensive periods, provided the link operates at its rated speed and integrity.

Answer

The color of the firewall chassis.

Answer

The type of ethernet cable used.

Question 5

A network security analyst is configuring a new Palo Alto Networks firewall. They need to create an Address Object for a server that has a hostname of 'web01.example.com' but also has a static IP address of 192.168.1.10. The analyst wants the firewall to resolve the hostname dynamically in case the IP changes. Which type of Address Object should they create?

Accepted Answer

FQDN Address Object. An FQDN Address Object is specifically designed to resolve a hostname to an IP address and keep it updated. This allows the firewall to adapt to IP changes without manual intervention. The other object types are static in nature and do not support dynamic DNS resolution, making them unsuitable for a server whose IP might change.

Answer

Dynamic Address Group

Answer

IP Range Address Object

Answer

IP Netmask Address Object

Question 6

A NetSec-Analyst is creating a Security Policy rule to permit a specific internal application for the finance department. The application uses a custom TCP port that is not recognized by App-ID, and the analyst wants to match traffic based on the destination port. Which configuration element must be used in the Security Policy rule to match the custom TCP port?

Accepted Answer

Service object. When an application is not recognized by App-ID and uses a custom TCP port, the analyst must use a Service object to match the destination port. Service objects allow granular control over port-based traffic, which is necessary when App-ID cannot identify the application. This ensures the Security Policy rule correctly permits the finance department's application.

Answer

URL category

Answer

HIP profile

Answer

Application filter

Question 7

A network security administrator is managing a Palo Alto Networks NGFW in a high-security environment. The administrator needs to ensure that all administrative access to the firewall's web interface is encrypted and that administrators are authenticated using multi-factor authentication (MFA). The environment uses an external LDAP server for user credentials and a RADIUS server for MFA. Which configuration should the administrator implement to meet these requirements?

Accepted Answer

Configure an authentication profile that uses LDAP for primary authentication and RADIUS for MFA, and enforce HTTPS for the management interface.. The requirement is to use LDAP for user credentials and RADIUS for MFA, while ensuring encrypted administrative access. An authentication profile that combines LDAP for primary authentication and RADIUS for MFA achieves the multi-factor requirement. Enforcing HTTPS on the management interface ensures that all administrative sessions are encrypted. This integrated approach leverages existing infrastructure and meets security policies.

Answer

Configure an authentication profile that uses RADIUS for primary authentication and LDAP for MFA, and enforce HTTPS for the management interface.

Answer

Configure an authentication profile that uses LDAP for both primary authentication and MFA, and enforce HTTPS for the management interface.

Answer

Configure an authentication profile that uses RADIUS for both primary authentication and MFA, and enforce HTTPS for the management interface.

Question 8

A NetSec-Analyst is finalizing a Security Policy rule set on a Palo Alto Networks firewall. The change window requires that all rules be documented so that a future analyst can understand the business justification without contacting the original author. The analyst wants the justification stored inside the policy itself so it travels with the configuration backup. Which policy element should the analyst populate to meet this requirement?

Accepted Answer

The Rule Comments field on each Security Policy rule. Rule Comments is the field designed to hold human-readable documentation attached directly to a Security Policy rule. Because it is part of the rule definition, it is captured in configuration backups, exports, and restores, letting a later analyst understand the business justification without outside references. Zone descriptions, external ticket numbers, and object tags all live outside the rule and therefore cannot satisfy the requirement.

Answer

A separate change-management ticket referenced by rule name

Answer

The Description field on the associated security zone objects

Answer

The tag applied to the address objects used as rule sources

Question 9

A security analyst is troubleshooting why the firewall is not generating a specific type of log. The analyst suspects that the log forwarding profile is not correctly attached to the security policy rule. Where in the PAN-OS web interface can the analyst verify which log forwarding profile is applied to a specific security rule?

Accepted Answer

Policies > Security > Actions column. The security policy rule itself defines whether logging is enabled and which log forwarding profile is used. The Actions column in Policies > Security provides a quick way to see this association. Other locations either manage profiles globally or display logs, but not the rule-specific configuration. Verifying the rule's actions is essential for troubleshooting missing logs.

Answer

Device > Log Settings

Answer

Monitor > Logs > Traffic

Answer

Objects > Log Forwarding

Question 10

A security analyst is reviewing the firewall's log settings and notices that logs are being stored locally on the firewall's disk. The analyst needs to ensure that logs are also sent to an external syslog server for long-term retention and analysis. Which configuration step is required to forward logs to a syslog server?

Accepted Answer

Create a syslog server profile and attach it to a log forwarding profile.. Log forwarding to an external syslog server requires defining a syslog server profile and then referencing it in a log forwarding profile. That log forwarding profile must be attached to the relevant security rules or log sources. This two-tier configuration separates server definitions from forwarding rules, allowing flexibility. Other options either configure local storage or are incomplete.

Answer

Configure the syslog server under Device > Log Settings.

Answer

Enable syslog forwarding in the security policy rule.

Answer

Add the syslog server to the firewall's DNS settings.

Question 11

A NetSec-Analyst is planning a rulebase migration between two Palo Alto Networks firewalls managed by different Panorama appliances. The analyst must preserve rule order and intent, and wants to use configuration elements that are portable and self-contained rather than dependent on external systems. Which TWO practices best support a clean, auditable migration? (Choose two.)

Accepted Answer

Export the rulebase with its referenced objects and import them together so object references resolve. A portable, auditable migration requires that rules arrive with the objects they reference and that their evaluation order is deliberately reproduced. Exporting referenced objects alongside the rulebase keeps references intact on the target system, and recording each rule's position preserves first-match semantics so a broad permit cannot jump above a specific deny. Loosening enforcement or stripping documentation destroys the audit trail and hides migration errors.

Answer

Delete all rule comments before export to reduce configuration size

Answer

Convert all rules to a default allow posture during migration to avoid user outages

Answer

Rely on unresolved object references so the target firewall can auto-create missing objects on commit

Question 12

A network security analyst is defining a custom Application Object for a proprietary database that uses TCP ports 1521 and 1522, and the application performs a three-way handshake but never sends a FIN or RST. The analyst wants the firewall to correctly identify and allow this application. Which step is critical to ensure the firewall recognizes the application session?

Accepted Answer

Configure the Application Object with the correct TCP ports and enable 'Session End Detection' with a timeout, and set the application to use 'tcp' with 'timeout' as the session end condition.. The application's lack of FIN or RST means the firewall must use an inactivity timeout to detect session end. Configuring the Application Object with the correct TCP ports and enabling session end detection with a timeout allows the firewall to correctly identify and manage the application session. This approach avoids indefinite sessions and ensures proper resource management.

Answer

Configure the Application Object with a session timeout and enable 'session end detection' using the appropriate TCP half-closed or time-wait settings.

Answer

Define the Application Object with the correct TCP ports and set the 'Session End Detection' to 'tcp-fin' and 'tcp-rst' only.

Answer

Set the Application Object's timeout to 0 to rely on session end detection by the firewall's default behavior.

Question 13

A network security analyst is troubleshooting why a security policy is not matching traffic from a specific user. The policy is configured to allow HTTP traffic from the 'Trust' zone to the 'Untrust' zone for a specific source IP. The analyst runs 'test security-policy-match' and sees that the traffic matches a different policy that denies it. The analyst wants to determine the exact order of policy evaluation and why the deny policy is matching first. Which action should the analyst take?

Accepted Answer

Review the security policy rules in the web interface, sorted by rule order, and verify that the allow rule is above the deny rule.. Security policies are processed sequentially, and the first rule that matches the traffic is enforced. If a deny rule precedes an allow rule, the deny takes effect. The analyst must inspect the rule order to see that the allow rule is positioned incorrectly. This is a common misconfiguration in complex rule sets. Adjusting the order so that the allow rule appears before the deny rule will resolve the issue.

Answer

Use 'show counter global filter delta yes' to check for policy drop counters.

Answer

Run 'test security-policy-match' again with the same parameters to confirm the result.

Answer

Run 'show session all filter source <user-ip>' to see if a session already exists for the traffic.

Question 14

A security analyst is reviewing the firewall's administrative accounts and wants to enforce the principle of least privilege. The analyst needs to create a custom administrative role that allows a user to view security policies and logs but not modify them. Which two permissions should be assigned to this custom role? (Choose two.)

Accepted Answer

Read-only access to the Policies module. To adhere to least privilege, the custom role should grant only the minimum permissions needed: read-only access to the Policies module to view security rules and read-only access to the Logs module to review log data. Other permissions, even if read-only, provide access to unrelated areas and are not necessary for the task.

Answer

Read-only access to the Network module

Answer

Write access to the Objects module

Answer

Full access to the Device module

Question 15

A NetSec-Analyst must implement a rule so that only members of the 'finance-approvers' group can reach a payment processing system, and the group membership is maintained in the corporate directory. The firewall is already integrated with the directory service and user mapping is working for other rules. Which source configuration on the Security Policy rule enforces this requirement most precisely?

Accepted Answer

A source user group object referencing the directory group. A source user group object ties the rule to directory group membership through User-ID, so only sessions mapped to members of the approvers group match. Because the group is maintained in the directory, membership changes propagate without editing the rule. Address, region, and device objects all enforce network or endpoint attributes rather than the required identity condition.

Answer

A source address object for the finance subnet

Answer

A source device object for managed finance workstations

Answer

A source region object for the country where the finance team works