NetSec-Analyst Management And Operations Practice Test 5 — 15 Questions

Question 1

An analyst at a regional bank must produce a monthly access report showing every user who connected to the internal CRM over the previous 30 days, along with their source IP addresses and the specific application used. The report must be generated without querying each firewall individually, and it must be retained for one year. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure log forwarding to a centralized syslog or Cortex Data Lake and query the aggregated logs for the report.. Centralizing logs through forwarding to Cortex Data Lake or a syslog server creates a single source of truth that can be queried for user, source IP, and application across all firewalls. It also supports long-term retention and scheduled reporting, which the other approaches cannot deliver without manual consolidation.

Answer

Create a custom dashboard widget on one firewall that aggregates logs from all peer firewalls via the management plane.

Answer

Use the built-in PDF report generator on each firewall and merge the results into a single document.

Answer

Enable User-ID in the security policy and export the traffic logs from each firewall's Monitor tab to a CSV file.

Question 2

A security operations team wants to ensure that firewall configuration changes are reviewed and approved before being committed to production devices. The team uses a change management workflow and needs an audit trail of who made each change and when. Which capability should be implemented to meet these requirements?

Accepted Answer

Integrate the firewalls with a change management system that supports approval gates and logs all configuration commits with user identity.. A change management system with approval gates enforces review before commits and captures user identity in logs, creating an auditable record. RBAC and versioning are supportive controls but do not provide the required workflow or identity-linked audit trail on their own.

Answer

Configure role-based access control so that only senior engineers have write access to the firewall.

Answer

Schedule automatic daily commits of all pending changes to reduce the window of unauthorized modifications.

Answer

Enable configuration versioning and use the firewall's built-in diff tool to compare candidate and running configurations.

Question 3

A security analyst is reviewing the firewall's log forwarding configuration. The analyst needs to ensure that all traffic logs are sent to an external syslog server in a specific format. Which of the following must be configured to achieve this?

Accepted Answer

Log Forwarding profile with a syslog server profile. To forward logs to an external syslog server, the firewall must have both a Syslog Server profile defining the server and a Log Forwarding profile that references it and specifies which logs to forward. Neither component alone is sufficient.

Answer

Log Forwarding profile only

Answer

Syslog Server profile only

Answer

Email Server profile and Log Forwarding profile

Question 4

A security operations team is preparing to enable automated threat intelligence sharing between their Palo Alto Networks firewall and a third-party SIEM. They plan to use the firewall's built-in integration capabilities. Which TWO components must be configured to allow the firewall to send logs to the SIEM? (Choose two.)

Accepted Answer

Syslog server profile. To forward logs to a SIEM, the firewall must know where to send them and which logs to send. The Syslog server profile defines the destination server, and the Log Forwarding profile specifies the match criteria and references the Syslog profile. Together, they enable the firewall to transmit logs to the SIEM.

Answer

Email server profile

Answer

HTTP server profile

Answer

SNMP trap server profile

Question 5

A network security administrator is configuring a new firewall and needs to ensure that management traffic uses a specific interface and next-hop. Which feature should the administrator configure?

Accepted Answer

Service Route. Service Routes are the correct feature to define the source interface and next-hop for management services. They allow management traffic to be separated from data traffic, ensuring it uses the specified path.

Answer

Static Route

Answer

Policy-Based Forwarding

Answer

Virtual Router

Question 6

A network security analyst is reviewing the firewall's log settings and notices that the firewall is sending logs to an external syslog server. The analyst wants to ensure that only logs for denied traffic are forwarded to reduce noise. Which configuration should the analyst modify?

Accepted Answer

Log Forwarding profile. The Log Forwarding profile is the correct component because it allows you to specify match criteria, such as log type and action, and define forwarding destinations. By configuring a profile to match only denied traffic, the analyst ensures that only those logs are sent to the syslog server. The Syslog server profile only defines the server, and security policy rules control traffic, not forwarding. Log storage quota is unrelated to external forwarding.

Answer

Log Storage quota

Answer

Syslog server profile

Answer

Security policy rule

Question 7

A network security analyst is reviewing the firewall's logs and notices a high number of denied sessions from a specific internal IP address to various external destinations. The analyst wants to quickly identify the user associated with that IP address to determine if the activity is malicious. Which feature should the analyst use?

Accepted Answer

User-ID. User-ID is the feature that maps IP addresses to usernames by integrating with directory services such as Active Directory or LDAP. In this scenario, the analyst needs to identify the user behind an internal IP address that is generating denied sessions. By using User-ID, the analyst can quickly see which user is associated with that IP and investigate further. Therefore, User-ID is the correct answer.

Answer

Content-ID

Answer

GlobalProtect

Answer

App-ID

Question 8

A security administrator is configuring a firewall to send alerts when the number of failed login attempts exceeds a threshold. The administrator wants to avoid alerting on failed logins from the internal vulnerability scanner, which regularly performs brute-force tests. Which configuration should the administrator use?

Accepted Answer

Configure a Log Forwarding profile with a match list that excludes the scanner's IP address.. The correct approach is to use a Log Forwarding profile with a match list that excludes the scanner's IP address. This allows the firewall to generate logs for all failed logins but only forward those that do not originate from the scanner to the alerting system. Security policy rules and DoS profiles do not control log forwarding, and authentication profiles lack the required filtering capability.

Answer

Set up a DoS Protection profile to allow the scanner's IP address.

Answer

Modify the authentication profile to exclude the scanner's IP from failed login logging.

Answer

Create a Security policy rule to allow the scanner's traffic and disable logging on that rule.

Question 9

A network security administrator needs to give a junior analyst read-only visibility into traffic logs and threat logs on a production Palo Alto Networks firewall, but must ensure the analyst cannot change any configuration. Which built-in administrator role should be assigned?

Accepted Answer

read-only. The read-only administrative role provides exactly the monitoring visibility the analyst needs while blocking configuration changes. Roles such as superuser and deviceadmin grant write access that violates least privilege, and auditadmin does not expose traffic or threat logs. Assigning read-only keeps the production firewall protected while enabling investigation.

Answer

auditadmin

Answer

deviceadmin

Answer

superuser

Question 10

A security team is implementing a new firewall rule that allows access to a critical application. They want to ensure that the rule is only active during business hours (9 AM to 5 PM) on weekdays. Which configuration element should they use to enforce this time restriction?

Accepted Answer

Schedule. The correct answer is Schedule. In PAN-OS, a Schedule object defines specific time periods and days of the week. When attached to a security policy rule, the rule is only enforced during those times. This allows the team to restrict access to the critical application to business hours on weekdays. Therefore, Schedule is the appropriate configuration element to enforce the time restriction.

Answer

User-ID

Answer

Application Filter

Answer

Service

Question 11

A NetSec-Analyst is reviewing the firewall's management plane configuration. The administrator wants to ensure that the firewall can be managed securely from the internal network only, while still allowing the firewall to reach external services like DNS and NTP for updates. Which management interface configuration should be used?

Accepted Answer

Configure a management profile on the management interface that allows HTTPS and SSH from the internal subnet, and set a default gateway for the management interface.. The management interface is a dedicated out-of-band interface for administrative access. To restrict access to the internal network, a management profile must be applied that permits only specific services (HTTPS, SSH) from internal IP addresses. A default gateway on the management interface allows the firewall to reach external services for updates, while still keeping management access internal and secure.

Answer

Assign a public IP address to the management interface and configure a management profile that allows any source IP to connect via HTTPS.

Answer

Enable HTTP and Telnet on the management interface to simplify access, and rely on the internal network's security controls.

Answer

Use the dataplane interface for management by enabling HTTPS and SSH in a security policy, and do not configure the management interface.

Question 12

A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?

Accepted Answer

Create individual administrator accounts with unique usernames and assign appropriate roles.. Individual administrator accounts with unique usernames are essential for accountability because they allow the firewall to log each administrative action with the specific user who performed it. Shared accounts, even with strong authentication, cannot provide this traceability. Assigning roles ensures least privilege, but the key is unique identification. This approach is a fundamental security best practice.

Answer

Configure a syslog server to capture all configuration changes and correlate them with the 'admin' account.

Answer

Enable multi-factor authentication for the 'admin' account to ensure only authorized personnel can make changes.

Answer

Enable RADIUS authentication and map each administrator to the 'admin' role.

Question 13

A security analyst is reviewing the firewall's operational logs and notices that the firewall is not sending SNMP traps to the monitoring server. The analyst verifies that the SNMP community string is correct and the server is reachable. Which TWO additional configurations should the analyst check on the firewall? (Choose two.)

Accepted Answer

SNMP Trap Profile settings. The two additional configurations to check are the SNMP Trap Destination settings and the SNMP Trap Profile settings. The Trap Destination defines where traps are sent, and the Trap Profile defines which traps are generated. If either is missing or incorrect, traps will not be received by the monitoring server. The other options are less relevant: Log Forwarding profiles do not handle SNMP traps, SNMPv3 credentials are only needed for SNMPv3, and the management IP is not the primary cause.

Answer

Log Forwarding profile for SNMP

Answer

SNMPv3 user credentials

Answer

Firewall's management interface IP address

Question 14

A security operations team wants to retain firewall traffic logs for 180 days for compliance, but the on-box log storage only holds about 30 days. They want to keep logs searchable in the firewall's Logs viewer without adding external storage. Which action should the administrator take?

Accepted Answer

Add a dedicated log storage disk or expand the logging disk capacity on the firewall.. On-box log retention is a function of how much disk space is dedicated to logging, so expanding the logging disk extends the searchable window. Log Forwarding moves logs off-box, and there is no retention timer or compression toggle that achieves 180 days locally. Adding storage is the correct way to keep logs searchable on the firewall.

Answer

Enable log compression on the logging disk to double retention.

Answer

Increase the log retention period in the firewall's Log Storage settings.

Answer

Configure a Log Forwarding profile to send logs to an external syslog server.

Question 15

A network security analyst is reviewing the firewall's dashboard and notices that the 'Threat Prevention' license is about to expire in 30 days. The analyst needs to verify the current license status and expiry date for all subscriptions on the firewall. Which action should the analyst take?

Accepted Answer

Navigate to Device > Licenses and view the license table.. The Device > Licenses page is the authoritative place to check all installed licenses, their status, and expiration dates. It provides a comprehensive list and is the recommended method for verifying subscription details. Other options either provide incomplete information or are less direct. The analyst should use this page to confirm the Threat Prevention license status and plan renewal.

Answer

View the 'Subscription Status' widget on the Dashboard.

Answer

Check the System Logs for license-related events.

Answer

Run the 'show license' command in the CLI.