NetSec-Analyst Practice Test 2 — 30 Questions

Question 1

An administrator suspects that a specific App-ID is not correctly identifying traffic. Which log column should they examine to confirm the application match?

Accepted Answer

Application. The 'Application' column in the Traffic log explicitly displays what the firewall identified as the application for the session.

Answer

Category

Answer

Policy

Answer

Service

Question 2

What is the purpose of the 'Zone' in a Palo Alto Networks firewall?

Accepted Answer

To group interfaces for security enforcement. Zones are logical groupings of interfaces that allow for granular security policy enforcement.

Answer

To identify applications

Answer

To route traffic

Answer

To group IP addresses

Question 3

An organization has a strict requirement that all web traffic must be inspected. Which policy is required in addition to the Security policy to achieve this?

Accepted Answer

Decryption Policy. Decryption policy is necessary for the firewall to see inside SSL/TLS traffic.

Answer

Device Policy

Answer

NAT Policy

Answer

QoS Policy

Question 4

Which object type would you use to define a range of IP addresses (e.g., 10.1.1.1 to 10.1.1.50) in PAN-OS?

Accepted Answer

IP Range. An IP Range object is specifically designed to cover a non-CIDR block range of IP addresses.

Answer

IP Netmask

Answer

FQDN

Answer

Address Group

Question 5

A network security administrator is configuring a firewall to send alerts to an external SIEM when a critical threat is detected. The administrator wants to ensure that the alerts include the source and destination IP addresses, threat name, and severity. Which configuration step is necessary to achieve this?

Accepted Answer

Create a Log Forwarding profile that matches the threat log and specifies the SIEM as a syslog server, then attach it to the security policy.. To forward threat logs to an external SIEM with specific fields, a Log Forwarding profile must be created and attached to the security policy. The profile matches threat logs and specifies the syslog server (SIEM) as the destination. This ensures that when a threat is detected, the log is sent with the configured details. Other options either do not forward logs or forward the wrong log type.

Answer

Enable 'Log at Session Start' and 'Log at Session End' in the security policy to capture all traffic and forward to SIEM.

Answer

Set up an Email profile to send alerts to the SIEM's email address and include threat details in the email format.

Answer

Configure a syslog server in the Device > Server Profiles > Syslog section and enable threat logging globally.

Question 6

A network security analyst is troubleshooting a site-to-site VPN tunnel that is showing as 'up' but no traffic is passing through it. The analyst wants to verify if the firewall is encrypting and decrypting packets correctly. Which tool should the analyst use to capture and examine the packets?

Accepted Answer

Use the packet capture feature with a filter for the VPN tunnel interface to inspect encrypted and decrypted packets.. When a VPN tunnel is up but no traffic passes, the analyst must verify that packets are being encrypted and decrypted. Packet capture on the tunnel interface allows examination of both the encrypted outer packets and the decrypted inner packets. This confirms whether the firewall is processing traffic correctly. Other options like checking status or logs do not provide direct evidence of packet flow.

Answer

Review the system logs for IKE negotiation errors.

Answer

Check the VPN status in the web interface to see if the tunnel is up.

Answer

Run a traceroute from a host behind the firewall to a remote host to see where packets are dropped.

Question 7

When managing objects in SCM, which actions can be performed on tags? (Choose TWO)

Accepted Answer

Assigning a color. Option A (Assigning a color) is correct because Palo Alto Networks SCM (Strata Cloud Manager) allows administrators to assign a color to a tag, which serves as a visual label for quick identification and filtering of tagged objects. Option D (Applying to objects for organization) is correct because tags are metadata labels that can be attached to objects such as addresses, address groups, and policies to categorize, group, and organize them logically within SCM. Options B and C are incorrect because IP ranges and port protocols are attributes of address objects and service objects respectively, not of tags. Option E is incorrect because a security policy is a separate rule construct that can reference tags, but tags themselves do not create security policies.

Answer

Defining an IP range

Answer

Defining a port protocol

Answer

Creating a security policy

Question 8

A security analyst is tasked with reviewing the firewall's logs to identify potential security incidents. The analyst needs to ensure that logs are being forwarded to an external SIEM for long-term retention and analysis. Which TWO actions must the analyst verify are configured correctly on the firewall? (Choose two.)

Accepted Answer

A Log Forwarding profile is applied to security policy rules.. To forward logs to an external SIEM, the firewall must have a syslog server profile that defines the SIEM's address and port, and a Log Forwarding profile that references that syslog profile and is applied to security policy rules. These two components ensure logs are generated and sent to the SIEM. Other options, such as management gateway, Threat Prevention license, or local logging, do not enable external forwarding.

Answer

The firewall has a valid Threat Prevention license.

Answer

The firewall's management interface has a default gateway.

Answer

The security policy rules have logging enabled at session end.

Question 9

Which elements are required when creating a new custom Service Object? (Choose THREE)

Accepted Answer

Protocol. When creating a custom Service Object, the Protocol (A) is required because the firewall must know which IP protocol (e.g., TCP, UDP, ICMP) the service uses to match traffic correctly. The Port (C) is required because a service object defines the destination port (or port range) that the protocol operates on, such as TCP/443. The Name (D) is required because every service object must have a unique identifier used to reference it in security policy rules. Tag (B) is optional metadata used for grouping or filtering objects and is not mandatory for creation. Description (E) is also optional documentation and is not required for the object to function.

Answer

Tag

Answer

Description

Question 10

Where do you go in SCM to manage all your network objects in one location?

Accepted Answer

Objects tab. The 'Objects' tab is the centralized location for creating and managing all configuration objects.

Answer

Policies tab

Answer

Monitor tab

Answer

Device Settings tab

Question 11

What action should be taken before upgrading the PAN-OS version on a production firewall?

Accepted Answer

Take a configuration snapshot.. Taking a backup (configuration snapshot) is the most critical step to ensure a recovery path exists if the upgrade fails.

Answer

Delete all existing logs.

Answer

Change the management IP address.

Answer

Disable all security policies.

Question 12

You are migrating configurations to Strata Cloud Manager. What is the benefit of using Snippets?

Accepted Answer

They allow for reusable configuration templates across device groups. Snippets allow for the creation of reusable configuration templates that can be pushed to multiple device groups.

Answer

They are only for firewall hardware settings

Answer

They automatically detect viruses

Answer

They replace the need for security policies

Question 13

In a multi-vsys environment, how do you manage shared objects?

Accepted Answer

You must define the object in the 'Shared' scope. Objects can be defined as 'Shared' to make them available across all virtual systems on the firewall.

Answer

You must copy the object to each vsys

Answer

Objects cannot be shared across vsys

Answer

Use a tag to share them

Question 14

You want to create a group that contains both individual address objects and other address groups. Is this supported?

Accepted Answer

Yes, address groups support nesting. Yes, Address Groups support nesting, where they can contain both static objects and other groups.

Answer

No, groups can only contain static objects

Answer

Only if they are in the same device group

Answer

Only one level of nesting is allowed

Question 15

Which TWO items are considered 'Objects' in the PAN-OS environment?

Accepted Answer

Service objects. Addresses, services, and application groups are all examples of objects that can be referenced in policies.

Answer

User names

Answer

Security zones

Answer

Policy rules

Question 16

Which of the following is NOT a valid type of address object?

Accepted Answer

IP Protocol. Palo Alto Networks supports IP Netmask, IP Range, and FQDN objects. IP Protocol is not an address object type.

Answer

FQDN

Answer

IP Netmask

Answer

IP Range

Question 17

What is the result of applying a 'Log at Session End' setting in a security policy?

Accepted Answer

Record log when the connection closes. Logging at session end ensures a summary of the session (bytes transferred, duration) is recorded when the session terminates.

Answer

Bypass security

Answer

Log every packet

Answer

Deny all traffic

Question 18

A security operations team wants to ensure that firewall configuration changes are reviewed and approved before being committed to production devices. The team uses a change management workflow and needs an audit trail of who made each change and when. Which capability should be implemented to meet these requirements?

Accepted Answer

Integrate the firewalls with a change management system that supports approval gates and logs all configuration commits with user identity.. A change management system with approval gates enforces review before commits and captures user identity in logs, creating an auditable record. RBAC and versioning are supportive controls but do not provide the required workflow or identity-linked audit trail on their own.

Answer

Configure role-based access control so that only senior engineers have write access to the firewall.

Answer

Schedule automatic daily commits of all pending changes to reduce the window of unauthorized modifications.

Answer

Enable configuration versioning and use the firewall's built-in diff tool to compare candidate and running configurations.

Question 19

What is the significance of the 'Inheritance' setting when creating objects in a Device Group hierarchy?

Accepted Answer

It allows the object to be visible in child device groups. Objects created in a parent device group are inherited by child groups, ensuring consistency and reducing redundancy.

Answer

It prevents the object from being deleted

Answer

It requires all objects to have the same name

Answer

It automatically creates a copy of the object in the child group

Question 20

An administrator is unable to add an object to a specific Device Group. What is the most likely reason?

Accepted Answer

The object is inherited from a parent device group. If the object is defined in a parent Device Group, it is read-only in the child Device Group; it cannot be modified there.

Answer

The firewall is in maintenance mode

Answer

The object is already in use

Answer

The object name contains invalid characters