NetSec-Analyst Practice Questions 2 — 50 Questions

Question 1

What is the difference between 'Candidate Configuration' and 'Running Configuration'?

Accepted Answer

Candidate contains pending changes; Running is currently active.. The candidate configuration is the set of pending changes that have not yet been applied, while the running configuration is what is currently active.

Answer

Candidate is what is live; Running is what was last saved.

Answer

There is no difference.

Answer

Candidate is a backup; Running is for active edits.

Question 2

Which TWO of the following are benefits of using Strata Cloud Manager for enterprise firewall management?

Accepted Answer

Centralized visibility and reporting.. Option A (Centralized visibility and reporting) is correct because Strata Cloud Manager is Palo Alto Networks' cloud-delivered management plane that aggregates telemetry, logs, and health data from managed firewalls into a single console, giving administrators unified dashboards, analytics, and reporting across the entire estate. Option C (Uniform policy distribution across device groups) is correct because Strata Cloud Manager uses hierarchical device groups and policy objects to push consistent security rules and configurations to many firewalls at once, eliminating per-device manual configuration and reducing policy drift. The remaining options are incorrect: power supplies (B) are a physical hardware concern unrelated to a cloud management service, automatic hardware replacement (D) is a support/RMA function rather than a management-platform benefit, and interface speed (E) is determined by the firewall's hardware and link capabilities, not by Strata Cloud Manager.

Answer

Reduced need for local power supplies.

Answer

Automatic physical hardware replacement.

Answer

Increased local firewall interface speed.

Question 3

While building a security policy in Strata Cloud Manager, an analyst selects the destination field and finds that the required Address object does not yet exist. The analyst wants to create the Address object without leaving the policy rule editor. What is the correct action?

Accepted Answer

Use the inline Create New option in the destination object selector to define and save the Address object.. The policy rule editor in Strata Cloud Manager supports inline object creation through the Create New option in the object selector. Selecting it opens a form where the analyst defines the Address object, saves it, and the object is instantly selectable in the policy. This avoids leaving the editor and preserves unsaved policy changes.

Answer

Create the object in a separate browser tab, refresh the policy editor, then select the new object.

Answer

Type the raw IP address directly into the destination field and save the policy; the object is created automatically.

Answer

Close the policy editor, navigate to Objects > Addresses, create the object, then reopen the policy.

Question 4

A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?

Accepted Answer

test security-policy-match. The 'test security-policy-match' command is designed to simulate a traffic flow and report the exact security policy rule that would be applied, including implicit deny rules. Since the traffic is not generating logs or sessions, this tool provides immediate insight into rule matching without generating actual traffic. It allows the analyst to verify zone, address, user, and application parameters to pinpoint why the intended rule is not matching.

Answer

show session all filter source <user-IP>

Answer

debug dataplane packet-diag set filter match source <user-IP>

Answer

show running security-policy

Question 5

A network security analyst is configuring a rule that must permit outbound traffic to any IP address within the range 172.20.0.0 through 172.20.255.255. Instead of creating 256 separate address objects, the analyst wants to define a single object. Which object type should be used?

Accepted Answer

IP Range object. The requirement is to represent a contiguous block of IP addresses that does not align to a single CIDR prefix. An IP Range object is designed exactly for this purpose, allowing a start and end address to be defined in one object. Address Groups, FQDN objects, and Dynamic Address Groups serve different purposes and cannot statically define such a range.

Answer

Address Group

Answer

Dynamic Address Group

Answer

FQDN object

Question 6

An administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The application is used by multiple departments and will be referenced in several security policies. Which of the following is the correct way to create this Service Object?

Accepted Answer

Create a Service Object with protocol TCP and destination port 8443.. A Service Object must accurately reflect the protocol and port used by the application. Since the custom application uses TCP port 8443, the object should be defined with protocol TCP and destination port 8443. This ensures that policies referencing the object will correctly identify and control the traffic. Other protocols or port directions would not match the application's traffic.

Answer

Create a Service Object with protocol ICMP and type 8443.

Answer

Create a Service Object with protocol UDP and destination port 8443.

Answer

Create a Service Object with protocol TCP and source port 8443.

Question 7

Which of the following is an example of a 'Service' object?

Accepted Answer

TCP/80. HTTP, HTTPS, and SSH are common services defined as objects specifying the protocol and port.

Answer

10.0.0.1

Answer

Marketing_Dept

Answer

USA_Region

Question 8

An administrator wants to automate the deployment of security policy updates across 50 branch firewalls using Strata Cloud Manager. Which feature should they use?

Accepted Answer

Device Groups. Device groups allow for the grouping of firewalls so that policies can be pushed to all members simultaneously from SCM.

Answer

Templates

Answer

API Key Management

Answer

Dynamic Address Groups

Question 9

A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?

Accepted Answer

Export a named configuration snapshot from Device > Setup > Operations.. A named configuration snapshot exported from Device > Setup > Operations is a complete, web-restorable backup of the firewall configuration. Tech support files and certificate exports serve different purposes, and a raw config save to USB is not the standard web-restore path. Exporting the snapshot before a risky change is the correct safeguard.

Answer

Export the firewall's device certificate and private key.

Answer

Save a tech support file from Device > Support.

Answer

Run the request system config save command to write the config to a USB drive.

Question 10

A security analyst is reviewing the firewall's logs and notices a high number of 'session end' logs with reason 'policy-deny' for traffic from the internal network to an external IP. The analyst wants to determine if this is a security incident or misconfiguration. Which step should the analyst take first?

Accepted Answer

Check the security policy rulebase to see if a rule is blocking the traffic and review its purpose.. The first step is to review the security policy rulebase to identify which rule is causing the denies. This helps determine if the denies are intentional (e.g., a block rule for a known bad IP) or accidental (e.g., a misconfigured rule). Understanding the policy context guides further investigation and response, whether it is a security incident or a configuration issue.

Answer

Enable packet capture on the firewall to analyze the payload of the denied sessions.

Answer

Immediately block the external IP address using a deny rule to prevent potential data exfiltration.

Answer

Check the Threat Log for correlated threats related to the external IP.

Question 11

Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?

Accepted Answer

They allow the use of port ranges, such as 1000-2000.. Option B is correct because Service Objects in Strata Cloud Manager support port ranges (for example, 1000-2000) in addition to single ports, which lets administrators define a contiguous span of ports within one object rather than creating many individual entries. Option E is correct because Service Objects can be referenced inside Service Groups, and those groups can then be used in policy rules, simplifying and reducing the size of the rulebase. Option A is incorrect because tags are not automatically inherited from the policy rule a Service Object is applied to; tags are assigned to objects directly. Option C is incorrect because Service Objects are scoped to a folder/device group hierarchy and are not required to be globally unique across all Device Groups. Option D is incorrect because a Service Object defines a single protocol (TCP or UDP) with its port or port range, so TCP and UDP cannot be combined in one object.

Answer

They automatically inherit tags from the policy rule they are applied to.

Answer

They are globally unique across all Device Groups.

Answer

They support the definition of both TCP and UDP ports in a single object.

Question 12

A security analyst receives an alert that a critical server is communicating with a known malicious IP address. The analyst wants to block this traffic immediately without affecting other traffic. Which action should the analyst take?

Accepted Answer

Create a new security rule at the top of the rulebase denying traffic from the server to the malicious IP.. Creating a specific deny rule at the top of the security policy is the most precise way to block traffic between the server and the malicious IP. It ensures immediate enforcement and does not impact other traffic. Other methods like modifying existing rules or using URL filtering are either too broad or ineffective for IP-based blocking.

Answer

Add the malicious IP to a URL Filtering profile and apply it to the server's outbound rule.

Answer

Enable DNS Sinkhole to redirect the malicious IP to a block page.

Answer

Modify the existing outbound allow rule to deny all traffic from the server.

Question 13

When creating a Dynamic Address Group (DAG), what is the primary prerequisite for the object to populate successfully?

Accepted Answer

The IP address must have a tag associated with it via registration.. DAGs rely on Tags being registered to the IP address via VM-Series monitoring, XML API, or User-ID.

Answer

The interface must be configured as a DHCP server.

Answer

The IP address must be defined as a static Address Object.

Answer

The object must be added to a Service Group.

Question 14

Which THREE features are associated with an 'Application Filter'?

Accepted Answer

Technology. Application Filters group applications based on category, subcategory, and technology, and these filters update automatically as new applications are added to the PAN-OS database.

Answer

Destination port

Answer

Source IP address

Question 15

A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?

Accepted Answer

Use the 'debug dataplane packet-diag set filter' command to set up a packet capture.. To inspect packet payload for data exfiltration, the analyst must capture raw packets. The 'debug dataplane packet-diag set filter' command enables setting up a packet capture filter on the dataplane. Once captured, the packets can be viewed or exported for analysis, revealing the payload. Other commands provide session metadata or policy information but lack the ability to show actual packet contents.

Answer

Use the 'show counter global' command to check for anomalies.

Answer

Use the 'show session id' command to view session details.

Answer

Use the 'test security-policy-match' command to check policy rules.

Question 16

A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?

Accepted Answer

Review the Threat logs and WildFire verdicts for the host to identify malicious activity.. Threat logs and WildFire verdicts provide the evidence needed to determine whether the host is compromised, including malware detections and command-and-control signatures. Containment or remediation actions such as blocking or reimaging should follow confirmation, not precede it. Reviewing threat intelligence first ensures the response is justified and preserves forensic data.

Answer

Reset the host's network adapter and reimage the operating system.

Answer

Disable the security policy rule that denies the traffic to allow further observation.

Answer

Create a deny rule for the internal host to stop all outbound traffic immediately.

Question 17

When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?

Accepted Answer

Translated Address. In a NAT policy, the Translated Address field (sometimes labeled 'Translated Packet' or 'NAT Translated Address') specifies the IP address that the original source or destination is rewritten to. For destination NAT (DNAT), this is the internal address that external traffic is redirected to; for source NAT (SNAT), it is the public address outbound traffic appears to come from. The field name explicitly describes the post-translation address.

Answer

Destination Address

Answer

Service Port

Answer

Source Address

Question 18

An administrator wants to schedule signature updates to occur at 3:00 AM daily. Where is this configured?

Accepted Answer

Device > Dynamic Updates. The Device > Dynamic Updates page contains the schedule settings for various update types like Applications, Threats, and WildFire.

Answer

Policies > Security > Schedules

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Services

Question 19

What is the primary purpose of a 'Device Group' in the context of SCM?

Accepted Answer

To apply consistent security policies to multiple firewalls.. Device groups allow for the hierarchical grouping of firewalls for shared policy management, providing consistent security across the enterprise.

Answer

To group firewalls by physical location only.

Answer

To manage local user authentication.

Answer

To manage interface settings exclusively.

Question 20

A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?

Accepted Answer

Create individual administrator accounts with unique usernames and assign appropriate roles.. Individual administrator accounts with unique usernames are essential for accountability because they allow the firewall to log each administrative action with the specific user who performed it. Shared accounts, even with strong authentication, cannot provide this traceability. Assigning roles ensures least privilege, but the key is unique identification. This approach is a fundamental security best practice.

Answer

Configure a syslog server to capture all configuration changes and correlate them with the 'admin' account.

Answer

Enable multi-factor authentication for the 'admin' account to ensure only authorized personnel can make changes.

Answer

Enable RADIUS authentication and map each administrator to the 'admin' role.