NetSec-Analyst Management And Operations Practice Test 2 — 15 Questions

Question 1

A security analyst at a financial institution needs to ensure that all administrative changes to the Palo Alto Networks NGFW are logged and can be audited. The compliance team requires that each configuration change be associated with the administrator who made it and the time it occurred. The analyst must also ensure that the logs are retained for at least one year. Which action should the analyst take to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable configuration logging under Device > Log Settings and configure a log forwarding profile to an external syslog server.. To meet compliance requirements for auditing administrative changes, the firewall must log configuration changes with the administrator identity and timestamp. Enabling configuration logging under Device > Log Settings captures these details. Forwarding these logs to an external syslog server ensures long-term retention beyond the firewall's local storage. This combination provides the necessary audit trail and retention period.

Answer

Create a custom report in the ACC to show administrator activity and schedule it to be emailed monthly.

Answer

Set up a RADIUS server for administrator authentication and enable accounting on the RADIUS server.

Answer

Configure a Syslog server profile and forward all config logs to an external syslog server with a retention policy.

Question 2

A network security administrator needs to ensure that only authorized administrators can access the firewall's management interface. The administrator wants to implement multi-factor authentication (MFA) for administrative logins. Which authentication method should be configured on the firewall to support MFA?

Accepted Answer

SAML. To support MFA for administrative logins, the firewall must integrate with an identity provider that enforces a second factor. SAML is the standard protocol for this integration on PAN-OS. By configuring SAML authentication, administrators are redirected to the IdP for MFA before gaining access. Other methods like local, RADIUS, or LDAP do not natively provide MFA without additional components.

Answer

RADIUS with OTP

Answer

LDAP

Answer

Local database with strong password policy

Question 3

Where can an administrator view the current version of the App-ID database installed on a firewall?

Accepted Answer

Device > Dynamic Updates. The Device > Dynamic Updates page lists the versions of all installed dynamic updates, including Applications, Threats, and WildFire.

Answer

Monitor > Logs > System

Answer

Dashboard > System Resources

Answer

Network > GlobalProtect > Status

Question 4

An administrator wants to automate the deployment of security policy updates across 50 branch firewalls using Strata Cloud Manager. Which feature should they use?

Accepted Answer

Device Groups. Device groups allow for the grouping of firewalls so that policies can be pushed to all members simultaneously from SCM.

Answer

Templates

Answer

API Key Management

Answer

Dynamic Address Groups

Question 5

Which menu path in the NGFW GUI allows an administrator to view the status of all active security subscriptions?

Accepted Answer

Device > Licenses. The Device > Licenses page provides a comprehensive view of all active subscriptions, their expiration dates, and activation status.

Answer

Device > Setup > Management

Answer

Policies > Security > Subscriptions

Answer

Network > Interfaces > Global

Question 6

Which license is required to receive real-time updates for malicious file identification in the cloud?

Accepted Answer

WildFire. The WildFire subscription is specifically responsible for cloud-based malware analysis and real-time signature delivery.

Answer

GlobalProtect

Answer

URL Filtering

Answer

Threat Prevention

Question 7

An administrator needs to manage multiple NGFWs from a single interface using Strata Cloud Manager. Which task must be performed first to enable centralized policy management?

Accepted Answer

Register the firewall serial number in Strata Cloud Manager.. To manage devices in Strata Cloud Manager, the firewalls must be onboarded using the serial number and assigned to a device group within the SCM portal.

Answer

Configure an external dynamic list for device grouping.

Answer

Assign a valid license key to the firewall locally.

Answer

Enable Panorama mode on the NGFW local CLI.

Question 8

A firewall is reporting 'License Expired' for Threat Prevention. The administrator renewed the license in the Support Portal. What is the most likely cause for the warning to persist?

Accepted Answer

The administrator has not clicked 'Retrieve license keys from license server'.. Often, the firewall has not yet synced its local database with the updated information on the Palo Alto Networks license server.

Answer

The firewall needs a firmware upgrade.

Answer

The license server is down.

Answer

The Threat Prevention license is not compatible with the current PAN-OS version.

Question 9

An administrator wants to schedule signature updates to occur at 3:00 AM daily. Where is this configured?

Accepted Answer

Device > Dynamic Updates. The Device > Dynamic Updates page contains the schedule settings for various update types like Applications, Threats, and WildFire.

Answer

Policies > Security > Schedules

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Services

Question 10

What is the primary purpose of a 'Device Group' in the context of SCM?

Accepted Answer

To apply consistent security policies to multiple firewalls.. Device groups allow for the hierarchical grouping of firewalls for shared policy management, providing consistent security across the enterprise.

Answer

To group firewalls by physical location only.

Answer

To manage local user authentication.

Answer

To manage interface settings exclusively.

Question 11

Which type of account is typically used to manage Palo Alto Networks assets in the Customer Support Portal?

Accepted Answer

Customer Support Portal account. A Customer Support Portal (CSP) account allows users to view registered assets, manage licenses, and open support tickets.

Answer

Default 'admin' account

Answer

Strata Cloud Manager admin account

Answer

Local Administrator account

Question 12

An administrator attempts to commit configuration changes from SCM to a firewall, but the commit fails due to an 'invalid reference'. What is the most effective way to troubleshoot this?

Accepted Answer

Review the Task Manager logs for error details.. The 'Task Manager' in the SCM or the firewall GUI provides detailed logs about why a commit operation failed, including specific invalid references.

Answer

Force a firmware reinstall.

Answer

Delete all current policies and re-import.

Answer

Restart the firewall management plane.

Question 13

When configuring a firewall for Strata Cloud Manager, which connectivity requirement must be met?

Accepted Answer

The firewall must have outbound access to SCM via HTTPS.. The firewall must be able to reach specific Palo Alto Networks cloud service URLs to establish a connection to SCM.

Answer

The firewall must be in transparent mode.

Answer

The management interface must be on a public IP address.

Answer

SNMP must be enabled on all interfaces.

Question 14

A security analyst is reviewing logs in SCM and realizes that logs from a specific firewall are missing. What is the most likely cause?

Accepted Answer

The Log Forwarding profile is not configured to send to SCM.. For a firewall's logs to reach Strata Cloud Manager (SCM), a Log Forwarding profile must be configured on the firewall and attached to the relevant security policy rules, with SCM as the destination. Without this profile, the firewall generates logs locally but never forwards them to SCM, which explains the missing logs.

Answer

The firewall is too busy to send logs.

Answer

The firewall license is expired.

Answer

The App-ID database is outdated.

Question 15

How does an administrator perform a software update on a standalone firewall?

Accepted Answer

Device > Software. Software updates are managed in the Device > Software page, where you can download and install new versions of PAN-OS.

Answer

Network > Interfaces

Answer

Objects > Software

Answer

Device > Dynamic Updates