NetSec-Analyst Practice Test 9 — 10 Questions

Question 1

A network security analyst is reviewing the firewall's dashboard and notices that the 'Threat Prevention' license is about to expire in 30 days. The analyst needs to verify the current license status and expiry date for all subscriptions on the firewall. Which action should the analyst take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Navigate to Device > Licenses and view the license table.. The Device > Licenses page is the authoritative place to check all installed licenses, their status, and expiration dates. It provides a comprehensive list and is the recommended method for verifying subscription details. Other options either provide incomplete information or are less direct. The analyst should use this page to confirm the Threat Prevention license status and plan renewal.

Answer

View the 'Subscription Status' widget on the Dashboard.

Answer

Check the System Logs for license-related events.

Answer

Run the 'show license' command in the CLI.

Question 2

An administrator needs to create a new Security Policy rule that allows HTTP and HTTPS traffic from the internal network to a specific external web server. The internal network is already defined as an Address object, and the external server is defined as an FQDN object. Which additional object is required to complete the rule?

Accepted Answer

A Service object for TCP ports 80 and 443. To complete the Security Policy rule, the administrator must specify the service that matches HTTP and HTTPS. A Service object defining TCP ports 80 and 443 is required. The source and destination are already covered by the existing Address and FQDN objects. Other object types do not provide the necessary port-based service definition.

Answer

A Dynamic Address Group for the external server

Answer

An Application object for web-browsing

Answer

An Address Group containing the internal network and external server

Question 3

When deploying a new firewall, why is it critical to synchronize the clock with an NTP server?

Accepted Answer

To ensure accurate log timestamps and SSL certificate validation.. Accurate system time is essential for correct logging, certificate validation, and threat detection timing.

Answer

To ensure the license server accepts the activation.

Answer

To prevent unauthorized access to the web interface.

Answer

To allow for faster software downloads.

Question 4

Which TWO ways can an administrator verify that a security subscription is active?

Accepted Answer

Via the Device > Licenses GUI page.. Option A is correct because the Device > Licenses GUI page in PAN-OS displays the installed licenses and their status, allowing an administrator to confirm whether the security subscription is active. Option E is correct because the CLI command 'show system license' outputs the current license state, including subscription validity and expiration dates. Option B is incorrect because the physical serial number label only identifies the firewall hardware and does not indicate license or subscription status. Option C is incorrect because Traffic Logs record session activity, not licensing state. Option D is incorrect because pinging the license server only tests network reachability and does not verify that the subscription itself is active.

Answer

By reviewing the firewall's physical serial number label.

Answer

By checking the Traffic Logs.

Answer

By pinging the license server.

Question 5

Why might an Address Object using an IP Netmask return a validation error even if the IP is valid?

Accepted Answer

The IP address bits outside the mask are not zeroed out. The IP address must match the specified netmask (e.g., 10.1.1.5/24 is invalid because the host bits are set).

Answer

The netmask is too small

Answer

The address is in a private range

Answer

The address is already in use

Question 6

An administrator attempts to delete an Address Object that is referenced by a security policy. What will happen?

Accepted Answer

The deletion is blocked, and the administrator must remove the object from all policies first.. Strata Cloud Manager blocks the deletion of an object that is referenced in a security policy. The administrator must first remove the object from all policies, then delete it. This referential integrity check prevents accidental policy misconfigurations and ensures that policies always reference valid objects.

Answer

The object is deleted, and the policy rule automatically removes the reference.

Answer

The object is moved to a trash folder, and the policy continues to function using a cached copy.

Answer

The object is deleted, but the policy rule becomes invalid and stops matching traffic.

Question 7

A security analyst is reviewing a firewall policy that uses Security Profiles to protect against known threats. The analyst notices that a file download was allowed and later found to contain a malicious payload that should have been blocked by the antivirus profile. Which action should the analyst take to ensure the antivirus profile inspects the file content in real time?

Accepted Answer

Verify that the antivirus profile is attached to the security policy that allows the file download.. Security Profiles are only enforced when they are attached to a security policy that matches the traffic. Without the antivirus profile linked to the allowing rule, file downloads are not scanned, and malicious content can be delivered. The analyst must confirm the profile is applied to the correct policy, as other actions like changing the rule action or inspection mode do not address the missing profile attachment.

Answer

Configure the antivirus profile to use 'Stream-based' inspection instead of 'Buffer-based'.

Answer

Enable the 'Forward' action in the antivirus profile.

Answer

Change the security policy action from allow to deny.

Question 8

A security analyst is reviewing a firewall policy that includes a rule allowing traffic from the 'Trust' zone to the 'Untrust' zone with the Application ID 'any'. The analyst notices that the rule has no Security Profiles attached. The analyst wants to enforce a policy that all allowed traffic must be inspected for threats, but also wants to minimize the impact on legitimate traffic. What should the analyst do?

Accepted Answer

Attach a Security Profile Group to the existing rule with 'any' Application ID.. Attaching a Security Profile Group to the existing rule enforces threat inspection on all allowed traffic without changing the allowed applications. This minimizes impact because legitimate traffic continues to be allowed, but is now inspected. The other options either disrupt traffic or do not enforce inspection.

Answer

Create a new rule above the existing rule that denies all traffic without profiles.

Answer

Enable 'Log at Session End' on the rule and review logs to identify applications, then create specific rules.

Answer

Change the Application ID from 'any' to specific applications and attach a Security Profile Group.

Question 9

A network security analyst is troubleshooting an issue where a user cannot access a website. The analyst suspects that the traffic is being denied by a security policy. Which CLI command should the analyst use to simulate the flow and see which security policy rule is matching?

Accepted Answer

test security-policy-match. The 'test security-policy-match' command is designed to simulate a flow and determine which security policy rule matches and what action is taken. By providing the source, destination, user, application, and service, the analyst can see the exact rule and whether it allows or denies the traffic. This directly answers why the user cannot access the website, as it will show if a deny rule is matching or if no rule matches and the default deny applies.

Answer

show running security-policy

Answer

debug dataplane packet-diag set filter match source <user-IP>

Answer

show session all filter source <user-IP>

Question 10

What is the purpose of the 'Service' field in a Security Policy?

Accepted Answer

To define the port. The 'Service' field specifies the TCP/UDP ports to be allowed or denied, though App-ID is preferred.

Answer

To define the NAT rule

Answer

To define the application

Answer

To define the user