NetSec-Analyst Practice Test 6 — 10 Questions

Question 1

What is the difference between 'Candidate Configuration' and 'Running Configuration'?

Accepted Answer

Candidate contains pending changes; Running is currently active.. The candidate configuration is the set of pending changes that have not yet been applied, while the running configuration is what is currently active.

Answer

Candidate is what is live; Running is what was last saved.

Answer

There is no difference.

Answer

Candidate is a backup; Running is for active edits.

Question 2

Which TWO of the following are benefits of using Strata Cloud Manager for enterprise firewall management?

Accepted Answer

Centralized visibility and reporting.. Option A (Centralized visibility and reporting) is correct because Strata Cloud Manager is Palo Alto Networks' cloud-delivered management plane that aggregates telemetry, logs, and health data from managed firewalls into a single console, giving administrators unified dashboards, analytics, and reporting across the entire estate. Option C (Uniform policy distribution across device groups) is correct because Strata Cloud Manager uses hierarchical device groups and policy objects to push consistent security rules and configurations to many firewalls at once, eliminating per-device manual configuration and reducing policy drift. The remaining options are incorrect: power supplies (B) are a physical hardware concern unrelated to a cloud management service, automatic hardware replacement (D) is a support/RMA function rather than a management-platform benefit, and interface speed (E) is determined by the firewall's hardware and link capabilities, not by Strata Cloud Manager.

Answer

Reduced need for local power supplies.

Answer

Automatic physical hardware replacement.

Answer

Increased local firewall interface speed.

Question 3

While building a security policy in Strata Cloud Manager, an analyst selects the destination field and finds that the required Address object does not yet exist. The analyst wants to create the Address object without leaving the policy rule editor. What is the correct action?

Accepted Answer

Use the inline Create New option in the destination object selector to define and save the Address object.. The policy rule editor in Strata Cloud Manager supports inline object creation through the Create New option in the object selector. Selecting it opens a form where the analyst defines the Address object, saves it, and the object is instantly selectable in the policy. This avoids leaving the editor and preserves unsaved policy changes.

Answer

Create the object in a separate browser tab, refresh the policy editor, then select the new object.

Answer

Type the raw IP address directly into the destination field and save the policy; the object is created automatically.

Answer

Close the policy editor, navigate to Objects > Addresses, create the object, then reopen the policy.

Question 4

A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?

Accepted Answer

test security-policy-match. The 'test security-policy-match' command is designed to simulate a traffic flow and report the exact security policy rule that would be applied, including implicit deny rules. Since the traffic is not generating logs or sessions, this tool provides immediate insight into rule matching without generating actual traffic. It allows the analyst to verify zone, address, user, and application parameters to pinpoint why the intended rule is not matching.

Answer

show session all filter source <user-IP>

Answer

debug dataplane packet-diag set filter match source <user-IP>

Answer

show running security-policy

Question 5

A network security analyst is configuring a rule that must permit outbound traffic to any IP address within the range 172.20.0.0 through 172.20.255.255. Instead of creating 256 separate address objects, the analyst wants to define a single object. Which object type should be used?

Accepted Answer

IP Range object. The requirement is to represent a contiguous block of IP addresses that does not align to a single CIDR prefix. An IP Range object is designed exactly for this purpose, allowing a start and end address to be defined in one object. Address Groups, FQDN objects, and Dynamic Address Groups serve different purposes and cannot statically define such a range.

Answer

Address Group

Answer

Dynamic Address Group

Answer

FQDN object

Question 6

An administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The application is used by multiple departments and will be referenced in several security policies. Which of the following is the correct way to create this Service Object?

Accepted Answer

Create a Service Object with protocol TCP and destination port 8443.. A Service Object must accurately reflect the protocol and port used by the application. Since the custom application uses TCP port 8443, the object should be defined with protocol TCP and destination port 8443. This ensures that policies referencing the object will correctly identify and control the traffic. Other protocols or port directions would not match the application's traffic.

Answer

Create a Service Object with protocol ICMP and type 8443.

Answer

Create a Service Object with protocol UDP and destination port 8443.

Answer

Create a Service Object with protocol TCP and source port 8443.

Question 7

Which of the following is an example of a 'Service' object?

Accepted Answer

TCP/80. HTTP, HTTPS, and SSH are common services defined as objects specifying the protocol and port.

Answer

10.0.0.1

Answer

Marketing_Dept

Answer

USA_Region

Question 8

An administrator wants to automate the deployment of security policy updates across 50 branch firewalls using Strata Cloud Manager. Which feature should they use?

Accepted Answer

Device Groups. Device groups allow for the grouping of firewalls so that policies can be pushed to all members simultaneously from SCM.

Answer

Templates

Answer

API Key Management

Answer

Dynamic Address Groups

Question 9

A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?

Accepted Answer

Export a named configuration snapshot from Device > Setup > Operations.. A named configuration snapshot exported from Device > Setup > Operations is a complete, web-restorable backup of the firewall configuration. Tech support files and certificate exports serve different purposes, and a raw config save to USB is not the standard web-restore path. Exporting the snapshot before a risky change is the correct safeguard.

Answer

Export the firewall's device certificate and private key.

Answer

Save a tech support file from Device > Support.

Answer

Run the request system config save command to write the config to a USB drive.

Question 10

A security analyst is reviewing the firewall's logs and notices a high number of 'session end' logs with reason 'policy-deny' for traffic from the internal network to an external IP. The analyst wants to determine if this is a security incident or misconfiguration. Which step should the analyst take first?

Accepted Answer

Check the security policy rulebase to see if a rule is blocking the traffic and review its purpose.. The first step is to review the security policy rulebase to identify which rule is causing the denies. This helps determine if the denies are intentional (e.g., a block rule for a known bad IP) or accidental (e.g., a misconfigured rule). Understanding the policy context guides further investigation and response, whether it is a security incident or a configuration issue.

Answer

Enable packet capture on the firewall to analyze the payload of the denied sessions.

Answer

Immediately block the external IP address using a deny rule to prevent potential data exfiltration.

Answer

Check the Threat Log for correlated threats related to the external IP.