NetSec-Analyst Practice Test 3 — 25 Questions

Question 1

When creating a new tag, what is the default color assigned if not specified?

Accepted Answer

None/System Default. If no specific color is selected, the firewall assigns a default color or no color depending on the interface version.

Answer

Green

Answer

Red

Answer

Blue

Question 2

Which of the following are true regarding Dynamic Address Groups? (Choose TWO)

Accepted Answer

They do not require a commit to update membership. DAGs use tags to determine membership and are updated dynamically without a full commit in many modern PAN-OS versions.

Answer

They must be manually updated

Answer

They are slower than static groups

Answer

They only support IPv6

Question 3

What are the limitations of FQDN address objects? (Choose THREE)

Accepted Answer

They require the firewall to successfully resolve the FQDN. FQDN objects rely on DNS resolution, may not match traffic using different SNIs, and require the firewall to have DNS access.

Answer

They are only supported for internal IPs

Answer

They cannot be used in NAT policies

Question 4

Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?

Accepted Answer

They allow the use of port ranges, such as 1000-2000.. Service objects define protocol and port, and they can be grouped for easier management.

Answer

They automatically inherit tags from the policy rule they are applied to.

Answer

They are globally unique across all Device Groups.

Answer

They support the definition of both TCP and UDP ports in a single object.

Question 5

Which TWO options describe valid ways to handle traffic that is identified as 'unknown-tcp' in a security policy?

Accepted Answer

Use an Application Override policy. Unknown traffic can be explicitly allowed, dropped, or managed via an Application Override policy to identify it as a custom app.

Answer

Change the zone to 'Internal'

Answer

Disable NAT

Answer

Enable QoS on the interface

Question 6

Which THREE features are associated with an 'Application Filter'?

Accepted Answer

Technology. Application Filters group applications based on category, subcategory, and technology, and these filters update automatically as new applications are added to the PAN-OS database.

Answer

Destination port

Answer

Source IP address

Question 7

You want to create a group that contains both individual address objects and other address groups. Is this supported?

Accepted Answer

Yes, address groups support nesting. Yes, Address Groups support nesting, where they can contain both static objects and other groups.

Answer

No, groups can only contain static objects

Answer

Only if they are in the same device group

Answer

Only one level of nesting is allowed

Question 8

Which object type is most appropriate for a web proxy that uses a hostname?

Accepted Answer

FQDN. FQDN objects are designed to handle hostnames that resolve to changing IP addresses.

Answer

Address Group

Answer

IP Netmask

Answer

Service Object

Question 9

Why might an Address Object using an IP Netmask return a validation error even if the IP is valid?

Accepted Answer

The IP address bits outside the mask are not zeroed out. The IP address must match the specified netmask (e.g., 10.1.1.5/24 is invalid because the host bits are set).

Answer

The netmask is too small

Answer

The address is in a private range

Answer

The address is already in use

Question 10

What is the benefit of using an Address Group over a single Address Object?

Accepted Answer

It simplifies policy management by allowing you to add/remove members in one place. Address Groups allow you to manage a collection of objects as a single unit, which is highly efficient for policy grouping.

Answer

It allows for faster packet matching

Answer

It is required for NAT

Answer

It improves security

Question 11

What happens if you delete an object that is currently in use by a Security Policy?

Accepted Answer

The system prevents the deletion until the reference is removed. PAN-OS prevents the deletion of an object if it is referenced by a policy, requiring the administrator to remove the reference first.

Answer

The policy is deleted

Answer

The policy is automatically disabled

Answer

The policy uses 'any' instead

Question 12

What is the 'Any' object?

Accepted Answer

A system-defined object representing all IP addresses. The 'Any' object is a pre-defined system object that represents all possible IP addresses and subnets.

Answer

A user-created object

Answer

An object for internal traffic only

Answer

An object that matches no traffic

Question 13

What is the 'Read-Only' state of an object indicating in SCM?

Accepted Answer

The object is inherited from a parent device group. An object is read-only if it is inherited from a parent device group, meaning it cannot be modified at the current level.

Answer

The administrator lacks permissions

Answer

The object is corrupted

Answer

The object is in use by a rule

Question 14

Which of the following are valid types of address objects? (Choose TWO)

Accepted Answer

IP Netmask. IP Netmask and FQDN are both standard address object types in PAN-OS.

Answer

Service Port

Answer

Application ID

Answer

Security Profile

Question 15

Which elements are required when creating a new custom Service Object? (Choose THREE)

Accepted Answer

Protocol. Service objects require a name, a protocol, and at least one port.

Answer

Tag

Answer

Description

Question 16

An administrator wants to prioritize VoIP traffic over all other traffic. Which policy type is the best choice?

Accepted Answer

QoS Policy. QoS policy allows classifying and prioritizing traffic based on class settings and interface bandwidth.

Answer

Security Policy

Answer

NAT Policy

Answer

Decryption Policy

Question 17

What happens if a packet matches multiple security policies?

Accepted Answer

It matches the first one in the list. The firewall evaluates policies from top to bottom and matches the first rule that criteria apply to.

Answer

It is dropped automatically

Answer

It matches the last one

Answer

It matches all of them

Question 18

Which TWO items are considered 'Objects' in the PAN-OS environment?

Accepted Answer

Service objects. Addresses, services, and application groups are all examples of objects that can be referenced in policies.

Answer

User names

Answer

Security zones

Answer

Policy rules

Question 19

When you use an Application Group in a policy, what happens if you add a new application to that group?

Accepted Answer

The policies using the group are updated automatically. Any security policy referencing that Application Group will automatically include the new application, improving policy agility.

Answer

The policy breaks

Answer

You must recreate the policy

Answer

You must re-save all policies

Question 20

An administrator notices high CPU usage on the management plane. Which command should be used to identify which process is causing the load?

Accepted Answer

show system resources. The 'show system resources' command provides a real-time view of CPU and memory utilization per process.

Answer

debug dataplane packet-diag

Answer

show system statistics

Answer

show system info