NetSec-Analyst Practice Test 3 — 10 Questions

Question 1

Which THREE criteria can be used to filter traffic logs in the Monitor tab?

Accepted Answer

Destination port.. In the Monitor tab's traffic log filtering, destination port (A) is a valid criterion because logs record the Layer 4 port of the session, allowing filters such as destination port 443 to isolate HTTPS traffic. Application name (D) is also valid since the firewall performs App-ID classification and stores the recognized application in the log, so filtering by application (e.g., ssl or web-browsing) is supported. Source IP address (E) is a valid filter because each traffic log entry includes the originating IP of the session, enabling queries for a specific host or subnet. Options B (power supply voltage) and C (CPU temperature) are hardware and environmental metrics, not fields present in traffic logs, so they cannot be used to filter log entries in the Monitor tab.

Answer

Power supply voltage.

Answer

CPU temperature.

Question 2

A security analyst is reviewing a security policy that has the action 'allow' and the profile 'strict' applied. The profile includes antivirus, anti-spyware, and vulnerability protection. A user reports that a file download from a trusted site is being blocked. The analyst checks the Threat log and sees a 'virus' signature with action 'block'. What is the most likely cause of the block?

Accepted Answer

The security policy action is set to 'allow', so the block must come from the Security Profile.. The block is caused by the Security Profile, specifically the antivirus component, which detected a virus signature and took the configured action to block. The security policy action 'allow' only permits the traffic; it does not perform content inspection.

Answer

The firewall's content update is out of date, causing a false positive.

Answer

The security policy action is set to 'deny', overriding the profile.

Answer

The file is blocked because the URL Filtering profile is missing.

Question 3

Which THREE items are required to successfully register a new firewall in the Customer Support Portal?

Accepted Answer

Valid Customer Support Portal account.. To register a new firewall in the Customer Support Portal, you must have a valid Customer Support Portal account (option B), since the registration process is tied to your authenticated user identity and licenses/devices are associated with that account. You also need the hardware serial number (option D), which uniquely identifies the specific firewall appliance and is used by the portal to bind the device record and its entitlements. Finally, a registration authorization code (option E) is required, as it is generated for the device and validates that the firewall is authorized to be added to your account. Options A and C are not required: a list of connected switch ports is irrelevant to portal registration, and the firewall's public SSH key is not used for this registration workflow.

Answer

A list of all connected switch ports.

Answer

The public SSH key of the firewall.

Question 4

A firewall is reporting 'License Expired' for Threat Prevention. The administrator renewed the license in the Support Portal. What is the most likely cause for the warning to persist?

Accepted Answer

The administrator has not clicked 'Retrieve license keys from license server'.. Often, the firewall has not yet synced its local database with the updated information on the Palo Alto Networks license server.

Answer

The firewall needs a firmware upgrade.

Answer

The license server is down.

Answer

The Threat Prevention license is not compatible with the current PAN-OS version.

Question 5

A security analyst is creating a new static Address Object on a Palo Alto Networks firewall to represent a partner company's web server at 203.0.113.45/32. The analyst must complete the required fields correctly for the object to commit and function in policy. Which two elements are required when defining this static Address Object? (Choose two.)

Accepted Answer

The IP address or subnet value. A static Address Object fundamentally needs two things: a unique name so it can be referenced unambiguously, and the IP address or subnet value that the firewall will match. Tags, descriptions, and DNS associations are optional attributes that enhance management or apply to other object types but are not required to create or use this object.

Answer

A tag assignment for the object

Answer

A description field entry

Answer

A DNS server association

Question 6

A security administrator is configuring a firewall to send alerts when the number of failed login attempts exceeds a threshold. The administrator wants to avoid alerting on failed logins from the internal vulnerability scanner, which regularly performs brute-force tests. Which configuration should the administrator use?

Accepted Answer

Configure a Log Forwarding profile with a match list that excludes the scanner's IP address.. The correct approach is to use a Log Forwarding profile with a match list that excludes the scanner's IP address. This allows the firewall to generate logs for all failed logins but only forward those that do not originate from the scanner to the alerting system. Security policy rules and DoS profiles do not control log forwarding, and authentication profiles lack the required filtering capability.

Answer

Set up a DoS Protection profile to allow the scanner's IP address.

Answer

Modify the authentication profile to exclude the scanner's IP from failed login logging.

Answer

Create a Security policy rule to allow the scanner's traffic and disable logging on that rule.

Question 7

Which THREE resources should an administrator use to stay updated on security advisories and product changes?

Accepted Answer

Official PAN-OS Documentation site.. The Official PAN-OS Documentation site (A) is correct because it is the authoritative source for release notes, new features, and product changes across PAN-OS versions, keeping administrators informed of updates that affect their deployments. The Customer Support Portal (CSP) news (B) is correct because Palo Alto Networks publishes critical bulletins, field notices, and support-related announcements there that directly affect customers' environments. The Palo Alto Networks Security Advisories page (D) is correct because it is the dedicated, vendor-maintained source for vulnerability disclosures, CVE details, severity ratings, and fixed PAN-OS versions, which is exactly what administrators need to track security advisories. Random IT forums (C) are not authoritative and may contain inaccurate or outdated information, and local system logs (E) only reflect events on a single device rather than providing proactive, vendor-issued advisories or product change notifications.

Answer

Random IT forums on the internet.

Answer

The local system logs.

Question 8

Which TWO log types can be forwarded to an external collector from a Palo Alto firewall?

Accepted Answer

Traffic logs.. Traffic logs (C) are correct because the Palo Alto firewall generates session-level Traffic log entries that can be forwarded to external log collectors such as syslog servers, Panorama, or Cortex Data Lake via log forwarding profiles. Threat logs (E) are also correct because Threat log entries, generated when security profiles like Antivirus, Anti-Spyware, Vulnerability Protection, or URL Filtering detect malicious activity, are forwardable to external collectors through the same log forwarding mechanisms. Keyboard input logs (A) are not a log type produced by the firewall, as the platform does not capture keystroke data. Hardware diagnostic sensor readings (B) are internal system health metrics, not forwardable log types in the log forwarding profile configuration. BIOS boot sequences (D) occur at the hardware firmware level and are not part of the firewall's forwardable log categories.

Answer

Keyboard input logs.

Answer

Hardware diagnostic sensor readings.

Answer

BIOS boot sequences.

Question 9

Which object category is used to group various network services to simplify policy definitions?

Accepted Answer

Service Group. Service Groups are used to bundle individual service objects together.

Answer

Tag Group

Answer

Address Group

Answer

Profile Group

Question 10

When configuring a firewall for Strata Cloud Manager, which connectivity requirement must be met?

Accepted Answer

The firewall must have outbound access to SCM via HTTPS.. The firewall must be able to reach specific Palo Alto Networks cloud service URLs to establish a connection to SCM.

Answer

The firewall must be in transparent mode.

Answer

The management interface must be on a public IP address.

Answer

SNMP must be enabled on all interfaces.