NetSec-Analyst Practice Test 7 — 10 Questions

Question 1

Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?

Accepted Answer

They allow the use of port ranges, such as 1000-2000.. Option B is correct because Service Objects in Strata Cloud Manager support port ranges (for example, 1000-2000) in addition to single ports, which lets administrators define a contiguous span of ports within one object rather than creating many individual entries. Option E is correct because Service Objects can be referenced inside Service Groups, and those groups can then be used in policy rules, simplifying and reducing the size of the rulebase. Option A is incorrect because tags are not automatically inherited from the policy rule a Service Object is applied to; tags are assigned to objects directly. Option C is incorrect because Service Objects are scoped to a folder/device group hierarchy and are not required to be globally unique across all Device Groups. Option D is incorrect because a Service Object defines a single protocol (TCP or UDP) with its port or port range, so TCP and UDP cannot be combined in one object.

Answer

They automatically inherit tags from the policy rule they are applied to.

Answer

They are globally unique across all Device Groups.

Answer

They support the definition of both TCP and UDP ports in a single object.

Question 2

A security analyst receives an alert that a critical server is communicating with a known malicious IP address. The analyst wants to block this traffic immediately without affecting other traffic. Which action should the analyst take?

Accepted Answer

Create a new security rule at the top of the rulebase denying traffic from the server to the malicious IP.. Creating a specific deny rule at the top of the security policy is the most precise way to block traffic between the server and the malicious IP. It ensures immediate enforcement and does not impact other traffic. Other methods like modifying existing rules or using URL filtering are either too broad or ineffective for IP-based blocking.

Answer

Add the malicious IP to a URL Filtering profile and apply it to the server's outbound rule.

Answer

Enable DNS Sinkhole to redirect the malicious IP to a block page.

Answer

Modify the existing outbound allow rule to deny all traffic from the server.

Question 3

When creating a Dynamic Address Group (DAG), what is the primary prerequisite for the object to populate successfully?

Accepted Answer

The IP address must have a tag associated with it via registration.. DAGs rely on Tags being registered to the IP address via VM-Series monitoring, XML API, or User-ID.

Answer

The interface must be configured as a DHCP server.

Answer

The IP address must be defined as a static Address Object.

Answer

The object must be added to a Service Group.

Question 4

Which THREE features are associated with an 'Application Filter'?

Accepted Answer

Technology. Application Filters group applications based on category, subcategory, and technology, and these filters update automatically as new applications are added to the PAN-OS database.

Answer

Destination port

Answer

Source IP address

Question 5

A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?

Accepted Answer

Use the 'debug dataplane packet-diag set filter' command to set up a packet capture.. To inspect packet payload for data exfiltration, the analyst must capture raw packets. The 'debug dataplane packet-diag set filter' command enables setting up a packet capture filter on the dataplane. Once captured, the packets can be viewed or exported for analysis, revealing the payload. Other commands provide session metadata or policy information but lack the ability to show actual packet contents.

Answer

Use the 'show counter global' command to check for anomalies.

Answer

Use the 'show session id' command to view session details.

Answer

Use the 'test security-policy-match' command to check policy rules.

Question 6

A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?

Accepted Answer

Review the Threat logs and WildFire verdicts for the host to identify malicious activity.. Threat logs and WildFire verdicts provide the evidence needed to determine whether the host is compromised, including malware detections and command-and-control signatures. Containment or remediation actions such as blocking or reimaging should follow confirmation, not precede it. Reviewing threat intelligence first ensures the response is justified and preserves forensic data.

Answer

Reset the host's network adapter and reimage the operating system.

Answer

Disable the security policy rule that denies the traffic to allow further observation.

Answer

Create a deny rule for the internal host to stop all outbound traffic immediately.

Question 7

When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?

Accepted Answer

Translated Address. In a NAT policy, the Translated Address field (sometimes labeled 'Translated Packet' or 'NAT Translated Address') specifies the IP address that the original source or destination is rewritten to. For destination NAT (DNAT), this is the internal address that external traffic is redirected to; for source NAT (SNAT), it is the public address outbound traffic appears to come from. The field name explicitly describes the post-translation address.

Answer

Destination Address

Answer

Service Port

Answer

Source Address

Question 8

An administrator wants to schedule signature updates to occur at 3:00 AM daily. Where is this configured?

Accepted Answer

Device > Dynamic Updates. The Device > Dynamic Updates page contains the schedule settings for various update types like Applications, Threats, and WildFire.

Answer

Policies > Security > Schedules

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Services

Question 9

What is the primary purpose of a 'Device Group' in the context of SCM?

Accepted Answer

To apply consistent security policies to multiple firewalls.. Device groups allow for the hierarchical grouping of firewalls for shared policy management, providing consistent security across the enterprise.

Answer

To group firewalls by physical location only.

Answer

To manage local user authentication.

Answer

To manage interface settings exclusively.

Question 10

A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?

Accepted Answer

Create individual administrator accounts with unique usernames and assign appropriate roles.. Individual administrator accounts with unique usernames are essential for accountability because they allow the firewall to log each administrative action with the specific user who performed it. Shared accounts, even with strong authentication, cannot provide this traceability. Assigning roles ensures least privilege, but the key is unique identification. This approach is a fundamental security best practice.

Answer

Configure a syslog server to capture all configuration changes and correlate them with the 'admin' account.

Answer

Enable multi-factor authentication for the 'admin' account to ensure only authorized personnel can make changes.

Answer

Enable RADIUS authentication and map each administrator to the 'admin' role.