NetSec-Analyst Practice Test 5 — 25 Questions

Question 1

A security administrator is building a URL Filtering profile in Strata Cloud Manager. The organization has a list of 40 marketing-related domains that must be allowed for the Marketing department, but these same domains should be blocked for all other departments. The administrator wants to reuse this list across multiple profiles without retyping the domains each time. Which object type should be created to satisfy this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A custom URL Category object containing the 40 domains, referenced by the URL Filtering profiles.. A custom URL Category object is the correct construct because it stores a reusable list of domains or URLs that URL Filtering profiles can reference. Because the profile applies the same category with different actions per department, centralizing the domain list avoids duplication and reduces the risk of inconsistent allow/block behavior across profiles.

Answer

A Dynamic Address Group with a tag-based filter matching the marketing domains.

Answer

An External Dynamic List (EDL) that pulls the domains from an HTTPS source.

Answer

A Service object with the domains entered as destination FQDN entries.

Question 2

A security analyst is investigating a potential breach. The analyst needs to correlate network traffic logs with threat logs to identify which internal host triggered a specific threat signature. Which Palo Alto Networks feature should be used to efficiently perform this correlation?

Accepted Answer

Unified logs in the Monitor tab. The Monitor tab's unified logs allow analysts to view and filter traffic, threat, URL, and other logs in one place. By examining a threat log, one can obtain the session ID and then search the traffic logs for that session to identify the internal host. This correlation is essential for efficient incident investigation without needing external tools.

Answer

Packet Capture

Answer

Application Command Center (ACC)

Answer

Log Forwarding profile

Question 3

A network security analyst is onboarding a new Palo Alto Networks firewall managed by Panorama. The security team wants to block outbound access to a known command-and-control (C2) domain used by a recent malware campaign. The domain resolves to multiple, frequently changing IP addresses. Which object type should the analyst create to reliably enforce this block in a Security Policy rule?

Accepted Answer

FQDN Address Object. Because the malicious destination is identified by a domain name whose IP addresses change over time, an FQDN Address Object is the appropriate construct. It resolves the domain and refreshes the associated IP addresses, so a Security Policy rule referencing it continues to block the C2 traffic without manual intervention. Static and service objects cannot track resolution changes.

Answer

Dynamic Address Group

Answer

Service Object

Answer

Static Address Object

Question 4

A network security analyst is reviewing the firewall's configuration logs and notices that a recent commit changed the behavior of a security policy. The analyst wants to identify exactly which administrator made the change and what was modified. Which firewall feature should the analyst use?

Accepted Answer

Config Audit. Config Audit is designed to track and compare configuration versions on a Palo Alto Networks firewall. It records each commit, the administrator who performed it, and a detailed diff of the changes. This allows the analyst to pinpoint the exact modification and the responsible user. Other features like ACC, system logs, and threat logs focus on traffic or system events, not configuration history.

Answer

ACC (Application Command Center)

Answer

Threat Logs

Answer

System Logs

Question 5

An analyst is building a new Security Policy rule set for a data center firewall. Several rules need to reference the same set of ten web server IP addresses in the DMZ. Rather than entering all ten IPs into every rule individually, the analyst wants a single reusable object that contains all of them. Which object type should the analyst create?

Accepted Answer

Address Group. An Address Group is the correct construct because it holds multiple Address Objects and can be referenced as a single entity in Security Policy rules. Creating one group for the ten DMZ web servers means future changes, such as adding or removing a server, require editing only the group rather than every rule, which reduces error and administrative overhead.

Answer

External Dynamic List

Answer

Service Group

Answer

Application Group

Question 6

A security analyst is configuring a firewall to allow a custom line-of-business application that communicates on TCP ports 8443 and 9443. The application vendor also uses UDP port 500 for keepalive traffic. The analyst wants a single reusable object that represents all of these port and protocol combinations so the same object can be referenced in multiple Security Policy rules. Which object type should the analyst create?

Accepted Answer

A Service Group containing separate Service Objects for TCP/8443, TCP/9443, and UDP/500. Because the application uses multiple protocol and port combinations, the analyst needs individual Service Objects for each pair, then a Service Group to combine them into one reusable reference. This allows a single object to be attached to multiple Security Policy rules while still covering TCP/8443, TCP/9443, and UDP/500, keeping the rule set clean and consistent.

Answer

An Application Group containing the vendor application signature

Answer

An Address Group containing the application server IP addresses

Answer

A single Service Object defining TCP/8443 only

Question 7

A security operations team is planning to implement a new firewall rule that allows HTTP traffic from the guest network to an external web server. They want to ensure the rule is as specific as possible and adheres to the principle of least privilege. Which two additional parameters should they configure to restrict the rule? (Choose two.)

Accepted Answer

Specify the destination IP address of the web server.. To restrict the rule to only the intended web server and application, the team should specify the destination IP address and set the application to 'web-browsing'. These parameters limit the rule's scope to exactly what is needed, following least privilege. Logging, URL category 'any', and changing the source zone do not tighten the rule; they either have no restrictive effect or are incorrect for the scenario.

Answer

Enable logging at session start.

Answer

Set the source zone to 'trust' instead of 'guest'.

Answer

Add a URL category of 'any'.

Question 8

A network security analyst is configuring an object in Strata Cloud Manager (SCM) to represent a partner company's web portal that is reachable at portal.example.com and resolves to several changing public IP addresses. The analyst wants the security policy to remain valid even when the partner rotates its DNS records. Which object type should the analyst create to satisfy this requirement?

Accepted Answer

FQDN Address object. An FQDN Address object is the right fit because it resolves a hostname to IP addresses at policy evaluation time, so DNS changes by the partner are absorbed automatically. Static address types and tag-driven dynamic groups do not perform DNS resolution, meaning they would require manual updates and could break the security policy when the partner's records change.

Answer

Dynamic Address Group with a tag filter

Answer

Static Address Group containing the current IP addresses

Answer

IP Netmask Address object

Question 9

A NetSec-Analyst is configuring a new Security Policy rule to allow outbound access to a partner's web server. The partner has provided a hostname but warns that the IP address may change without notice. The analyst wants the policy to keep working if the IP changes. Which object type should the analyst use for the destination?

Accepted Answer

FQDN Address Object. The requirement is to follow a hostname whose IP may change. An FQDN Address Object performs DNS resolution and updates the resolved IP, allowing the policy to remain valid without manual intervention. Static objects, groups, and region objects do not provide hostname-based dynamic resolution.

Answer

Static Address Object

Answer

Address Group

Answer

Region Object

Question 10

An administrator is configuring a Decryption policy on a Palo Alto Networks firewall. The policy must decrypt outbound SSL traffic to inspect for threats, but certain financial websites must be excluded from decryption to comply with privacy regulations. Which action should the administrator take?

Accepted Answer

Create a no-decrypt rule for the financial URL categories and place it above the decrypt rule.. To exclude specific websites from SSL decryption, the administrator must create a no-decrypt rule for those URL categories and position it above the decrypt rule. Decryption policies are evaluated in order, so the no-decrypt rule must match first. Modifying the decryption profile or disabling decryption globally does not achieve the selective exclusion required for compliance.

Answer

Modify the decrypt rule to exclude the financial URL categories by adding them to the 'Exclude' list in the decryption profile.

Answer

Disable SSL decryption globally and rely on application signatures to detect threats in encrypted traffic.

Answer

Create a no-decrypt rule for the financial URL categories and place it below the decrypt rule.

Question 11

An analyst is registering a new firewall in Strata Cloud Manager (SCM) and needs to create a Security Zone object that is restricted to the 'internet' and 'dmz' interfaces only, so that later Security Policy rules can reference it. Which object type should the analyst create to meet this requirement?

Accepted Answer

Security Zone object with the internet and dmz interfaces assigned to it.. A Security Zone object is the only object type in SCM that inherently groups interfaces into a logical unit that policy rules can reference. Address, Service, and Application Filter objects operate on IPs, ports, or application signatures respectively and cannot represent interface membership. Creating a zone object with the two interfaces assigned gives the analyst a reusable, interface-aware reference for subsequent policy configuration.

Answer

Service object that lists the ports used by the internet and dmz interfaces.

Answer

Address Group containing the IP addresses of the internet and dmz interfaces.

Answer

Application Filter object matching applications commonly seen on internet and dmz links.

Question 12

An administrator is creating a new Address Object for a web server that has a hostname 'web01.example.com'. The administrator wants the firewall to resolve this hostname to an IP address dynamically. Which Address Object type should be used?

Accepted Answer

FQDN. To resolve a hostname dynamically, an FQDN Address Object is required. It performs DNS lookups and updates the IP address automatically. IP Netmask, IP Range, and Dynamic Address Group do not provide hostname resolution. The FQDN type is specifically designed for this purpose, ensuring that policies always use the current IP of the named host.

Answer

Dynamic Address Group

Answer

IP Netmask

Answer

IP Range

Question 13

An analyst is reviewing a security policy that references an Address object named Web-Server-Prod. A change request requires updating the object to a new IP address, but the object is referenced by multiple policies across several folders in Strata Cloud Manager. The analyst wants the change to take effect everywhere with minimal effort. What should the analyst do?

Accepted Answer

Edit the Web-Server-Prod object's IP address value; all policies referencing it inherit the update.. Because policies reference Address objects by name, editing the object's IP value automatically updates every rule that references it, regardless of folder. This is the primary advantage of object-based configuration: a single edit propagates consistently and eliminates the need to touch each policy, reducing effort and the chance of configuration drift.

Answer

Delete Web-Server-Prod and create a new object with the new IP, then update each policy manually.

Answer

Create a new Address object with the new IP and add it as a second destination in each policy.

Answer

Convert Web-Server-Prod into a Dynamic Address Group so it updates automatically.

Question 14

A security analyst manages a firewall through Panorama. The analyst deletes a Service Object that defines TCP/8080, but a Security Policy rule still references it. The analyst then attempts to push the configuration. What is the most likely outcome when the commit is validated?

Accepted Answer

The commit fails validation because the policy references a non-existent object. Security Policy rules depend on the objects they reference. When a referenced Service Object is deleted, the rule contains a dangling reference, and commit validation rejects the configuration because it cannot be resolved into a valid rule. The analyst must restore the object, remove the reference, or substitute a valid one before the push can succeed.

Answer

The rule is automatically disabled but the rest of the commit completes successfully

Answer

The commit succeeds and the rule silently ignores the missing object, allowing all ports

Answer

The firewall automatically recreates the deleted Service Object with default values

Question 15

A NetSec-Analyst is writing a security policy baseline for a Palo Alto Networks firewall. The security team wants to ensure that any traffic not explicitly permitted by a security policy is logged and blocked, but they also need to allow a temporary exception for a vulnerability scanner during an authorized penetration test. The scanner must be permitted from a specific management subnet to all internal zones. Which policy configuration best meets these requirements while maintaining least privilege?

Accepted Answer

Create an interzone policy from the management zone to the specific internal zones, source scanner IP, application set to the specific scanner application signatures, and action allow, placed above the implicit deny rule.. The best policy restricts the source to the scanner IP, limits destinations to the specific internal zones, and uses specific application signatures, while being placed above the implicit deny rule. This enforces least privilege and maintains logging. Broad any-application rules, modifying the implicit deny, or universal allow rules all violate the principle of least privilege and fail to provide the required control.

Answer

Create an interzone policy from the management zone to all internal zones with the scanner's IP as source, application any, and action allow, placed above the implicit deny rule.

Answer

Modify the implicit deny rule to allow traffic from the management subnet to all zones, then rely on the scanner's own IP allowlist to restrict access.

Answer

Create a universal policy with source any, destination any, application any, and action allow, but enable security profiles to log all traffic.

Question 16

A security analyst needs to define a custom application object in Strata Cloud Manager for an internally developed line-of-business tool that uses TCP port 8443 and is not covered by any existing App-ID signature. The analyst wants the security policy to match this traffic by the custom application rather than by a port-based service. Which configuration step is required?

Accepted Answer

Create a custom Application object specifying the TCP port 8443, then reference it in the security policy.. When no App-ID signature covers an internal application, the correct approach is to create a custom Application object that defines the port and protocol, then reference it in the policy. This gives application-based matching and control for the custom tool, which a port-only Service object or an Application Filter cannot provide.

Answer

Create an Application Filter that includes the port range and reference it in the policy.

Answer

Create an External Dynamic List that contains the tool's server IP and reference it as an application.

Answer

Create a Service object for TCP 8443 and use it in the policy's service field.

Question 17

A network security analyst is configuring a new Security Policy rule that must block traffic to a known malicious IP address. During policy creation, the analyst selects the 'Destination Address' field and realizes the malicious IP has not been defined as an Address Object yet. What is the most efficient action the analyst can take directly from the policy rule configuration interface?

Accepted Answer

Use the Object Selector within the Destination Address field to create a new Address Object inline.. The Object Selector within the Destination Address field enables inline creation of a new Address Object, allowing the analyst to define the malicious IP without leaving the policy rule. This is the most efficient method because it maintains workflow continuity and immediately associates the new object with the rule. Other methods either require navigation away or skip object creation entirely.

Answer

Type the IP address directly into the Destination Address field, bypassing object creation entirely.

Answer

Navigate to the Objects tab, create a new Address Object, then return to the policy and select it.

Answer

Import a pre-existing Address Object from a CSV file using the policy import feature.

Question 18

A junior analyst needs to define a reusable object for TCP port 8443 so that multiple Security Policy rules can reference the same port without retyping it. Which object type should the analyst create?

Accepted Answer

Service object defining TCP port 8443.. A Service object is the standard construct for defining a protocol and port combination that policy rules can reuse. Address objects hold IPs, Application Filters match by application behavior, and Security Zone objects group interfaces. Only the Service object cleanly captures tcp/8443 and allows centralized updates when the port definition changes across many rules.

Answer

Application Filter matching web-browsing on port 8443.

Answer

Security Zone object configured for TCP port 8443.

Answer

Address object with the value tcp/8443.

Question 19

A security administrator is reviewing the object list in Panorama's Shared policy. The administrator notices that an Address Object named 'Server1' is referenced by several security policies. A change request asks to modify the IP address of 'Server1'. What will happen to the policies that reference this object after the change is committed?

Accepted Answer

The policies will automatically update to use the new IP address.. Address Objects are referenced by policies, so modifying the object's IP address automatically updates all policies that use it after commit. The policies do not need to be recreated or manually edited, and the change is not blocked. This object-based approach ensures consistency and simplifies administration.

Answer

The policies will still use the old IP address until manually edited.

Answer

The policies will become invalid and must be recreated.

Answer

The change will be blocked because the object is in use.

Question 20

A security administrator is creating a new Address Group to simplify policy management. The administrator wants to include a mix of static IP addresses and a Dynamic Address Group (DAG) that contains servers tagged as 'web'. Which two statements are true regarding the configuration of this Address Group? (Choose two.)

Accepted Answer

The Address Group can contain both static address objects and dynamic address groups as members.. Address Groups can contain both static address objects and dynamic address groups, allowing mixed membership. Additionally, when a DAG's membership changes, the parent Address Group automatically reflects those changes because the DAG is evaluated dynamically. This enables administrators to combine static and dynamic elements in a single group for use in policy rules, simplifying management and ensuring up-to-date IP lists.

Answer

The Address Group must be of type 'Dynamic' to include a DAG as a member.

Answer

Static address objects within the Address Group are automatically converted to dynamic tags.

Answer

The Address Group can only contain objects of the same type (either all static or all dynamic).