NetSec-Analyst Management And Operations Practice Test 6 — 15 Questions

Question 1

A security analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were transferred out of the network and whether any contained sensitive information. Which Palo Alto Networks feature should the analyst use to identify file transfers and inspect their content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Filtering Profile. The correct answer is Data Filtering Profile. Data Filtering profiles allow you to define patterns (such as credit card numbers, social security numbers, or custom regex) and apply them to file transfers. When a file containing such patterns is detected, the firewall can generate an alert or block the transfer. In this scenario, the analyst can use Data Filtering to identify files that were transferred and contained sensitive information. Thus, Data Filtering is the correct feature.

Answer

File Blocking Profile

Answer

URL Filtering Profile

Answer

Antivirus Profile

Question 2

A security analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were transferred out of the network and whether any contained sensitive information. Which Palo Alto Networks feature should the analyst use to identify file transfers and inspect their content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unified logs in the Monitor tab. The Monitor tab's unified logs allow analysts to view and filter traffic, threat, URL, and other logs in one place. By examining a threat log, one can obtain the session ID and then search the traffic logs for that session to identify the internal host. This correlation is essential for efficient incident investigation without needing external tools.

Answer

Packet Capture

Answer

Application Command Center (ACC)

Answer

Log Forwarding profile

Question 3

A security administrator needs to ensure that the firewall's configuration is backed up automatically every day and stored on an external server. The administrator wants to use the firewall's built-in capabilities without installing additional software. Which method should the administrator use?

Accepted Answer

Configure a scheduled configuration backup in Device > Setup > Operations. The firewall has a built-in scheduled configuration backup feature under Device > Setup > Operations. This allows administrators to define a schedule and specify an external server (SCP or FTP) to store the backups. The other options either require manual intervention, additional scripting, or misinterpret Panorama's capabilities. Thus, the scheduled backup in Device > Setup > Operations is the correct choice.

Answer

Schedule a configuration export via the firewall's Web UI

Answer

Use the firewall's XML API to schedule a daily configuration backup

Answer

Configure a scheduled job in Panorama to push configuration to the firewall

Question 4

A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?

Accepted Answer

Export a named configuration snapshot from Device > Setup > Operations.. A named configuration snapshot exported from Device > Setup > Operations is a complete, web-restorable backup of the firewall configuration. Tech support files and certificate exports serve different purposes, and a raw config save to USB is not the standard web-restore path. Exporting the snapshot before a risky change is the correct safeguard.

Answer

Export the firewall's device certificate and private key.

Answer

Save a tech support file from Device > Support.

Answer

Run the request system config save command to write the config to a USB drive.

Question 5

A network security administrator is configuring a firewall to send alerts to an external SIEM when a critical threat is detected. The administrator wants to ensure that the alerts include the source and destination IP addresses, threat name, and severity. Which configuration step is necessary to achieve this?

Accepted Answer

Create a Log Forwarding profile that matches the threat log and specifies the SIEM as a syslog server, then attach it to the security policy.. To forward threat logs to an external SIEM with specific fields, a Log Forwarding profile must be created and attached to the security policy. The profile matches threat logs and specifies the syslog server (SIEM) as the destination. This ensures that when a threat is detected, the log is sent with the configured details. Other options either do not forward logs or forward the wrong log type.

Answer

Enable 'Log at Session Start' and 'Log at Session End' in the security policy to capture all traffic and forward to SIEM.

Answer

Set up an Email profile to send alerts to the SIEM's email address and include threat details in the email format.

Answer

Configure a syslog server in the Device > Server Profiles > Syslog section and enable threat logging globally.

Question 6

A security administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management traffic (such as SSH and HTTPS) is only accessible from the internal management network. The firewall has multiple interfaces, and the administrator wants to restrict management access to a specific interface. Which configuration step should the administrator take?

Accepted Answer

Create a Management Profile that permits SSH and HTTPS from the internal network and apply it to the interface.. Management access to the firewall is controlled by Management Profiles, which specify allowed services and source IP addresses. Applying a Management Profile to a specific interface restricts management access to that interface and the defined sources. Security policies do not apply to management traffic, and other options either do not restrict to a specific interface or are not the correct mechanism.

Answer

Configure a Management Interface Profile and assign it to the management interface.

Answer

Create a Security policy rule that allows management traffic only from the internal network.

Answer

Enable 'Management Only' on the desired interface and disable it on others.

Question 7

A security administrator is configuring a new firewall to integrate with an external LDAP server for user authentication. The administrator needs to ensure that user groups are correctly mapped for policy enforcement. Which TWO actions must be performed to enable group mapping? (Choose two.)

Accepted Answer

Create a group mapping profile that specifies the group object class and attributes.. To enable group mapping from an LDAP server, two key actions are required: configuring an LDAP server profile with the correct base DN and bind credentials, and creating a group mapping profile that specifies the group object class and attributes. These steps allow the firewall to query the LDAP directory and retrieve group membership information, which can then be used in security policies. Without both, group mapping will not function correctly.

Answer

Set up a syslog server to receive User-ID logs.

Answer

Enable User-ID on the zone where users are located.

Answer

Configure a RADIUS server for authentication.

Question 8

A network security administrator is configuring a new firewall and wants to ensure that administrative access is logged for auditing purposes. Which configuration should be enabled to log all management access attempts?

Accepted Answer

Enable logging on the management interface's management profile.. Management access logging is configured within the management profile applied to the management interface. By enabling logging for the permitted services (e.g., HTTPS, SSH), the firewall generates logs for each access attempt. These logs are essential for auditing and monitoring administrative activities.

Answer

Enable 'Log at Session Start' in the management interface settings.

Answer

Configure a Syslog server profile and assign it to the management interface.

Answer

Create a security policy that logs all traffic to the management interface.

Question 9

A security administrator needs to grant a new team member read-only access to the firewall's web interface to view security policies and logs, but not make any changes. Which default administrator role should be assigned?

Accepted Answer

Superuser (read-only). The Superuser (read-only) role is a built-in administrative role that grants view-only access to all aspects of the firewall, including policies and logs. It is specifically designed for users who need to monitor and inspect without making changes. Other roles either provide write access or are not intended for read-only purposes.

Answer

Device administrator

Answer

Virtual system administrator

Answer

Superuser

Question 10

A network security analyst is reviewing the firewall's configuration logs and notices that a recent commit changed the behavior of a security policy. The analyst wants to identify exactly which administrator made the change and what was modified. Which firewall feature should the analyst use?

Accepted Answer

Config Audit. Config Audit is designed to track and compare configuration versions on a Palo Alto Networks firewall. It records each commit, the administrator who performed it, and a detailed diff of the changes. This allows the analyst to pinpoint the exact modification and the responsible user. Other features like ACC, system logs, and threat logs focus on traffic or system events, not configuration history.

Answer

ACC (Application Command Center)

Answer

Threat Logs

Answer

System Logs

Question 11

A network security analyst is reviewing the firewall's Security Policy and notices that the 'Allow-Web' rule has 15,000 hits in the last 24 hours, while a rule named 'Deny-Telnet' has zero hits. The analyst wants to reduce clutter and improve performance. Which action is most appropriate according to security best practices?

Accepted Answer

Review the rule's purpose and consider adding a log forwarding profile to capture denied Telnet attempts for auditing.. A deny rule with no hits should not be immediately disabled or deleted; it may be providing security by blocking unwanted traffic. The appropriate action is to enhance monitoring by configuring logging, which provides visibility into potential attempts. This maintains the rule's protective function while allowing the analyst to make informed decisions later based on data.

Answer

Delete the 'Deny-Telnet' rule because it is unused and therefore redundant.

Answer

Disable the 'Deny-Telnet' rule because it has no hits and is not needed.

Answer

Move the 'Deny-Telnet' rule to the top of the rulebase to ensure it is evaluated first.

Question 12

A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?

Accepted Answer

Review the Threat logs and WildFire verdicts for the host to identify malicious activity.. Threat logs and WildFire verdicts provide the evidence needed to determine whether the host is compromised, including malware detections and command-and-control signatures. Containment or remediation actions such as blocking or reimaging should follow confirmation, not precede it. Reviewing threat intelligence first ensures the response is justified and preserves forensic data.

Answer

Reset the host's network adapter and reimage the operating system.

Answer

Disable the security policy rule that denies the traffic to allow further observation.

Answer

Create a deny rule for the internal host to stop all outbound traffic immediately.

Question 13

A security analyst is tasked with reviewing the firewall's logs to identify potential security incidents. The analyst needs to ensure that logs are being forwarded to an external SIEM for long-term retention and analysis. Which TWO actions must the analyst verify are configured correctly on the firewall? (Choose two.)

Accepted Answer

A Log Forwarding profile is applied to security policy rules.. To forward logs to an external SIEM, the firewall must have a syslog server profile that defines the SIEM's address and port, and a Log Forwarding profile that references that syslog profile and is applied to security policy rules. These two components ensure logs are generated and sent to the SIEM. Other options, such as management gateway, Threat Prevention license, or local logging, do not enable external forwarding.

Answer

The firewall has a valid Threat Prevention license.

Answer

The firewall's management interface has a default gateway.

Answer

The security policy rules have logging enabled at session end.

Question 14

A security analyst is tasked with creating a report that shows the top application categories used by employees over the past week. The analyst needs to present this data to management. Which Palo Alto Networks feature provides this information with the least amount of manual effort?

Accepted Answer

Application Command Center (ACC). The Application Command Center (ACC) is designed to provide aggregated, graphical views of network activity, including top application categories. It allows filtering by time and offers pre-built widgets, making it the most efficient tool for generating a management report with minimal manual effort.

Answer

Custom reports in the Report Settings

Answer

Threat logs in the Monitor tab

Answer

Traffic logs in the Monitor tab

Question 15

A security operations team is planning to implement a new firewall rule that allows HTTP traffic from the guest network to an external web server. They want to ensure the rule is as specific as possible and adheres to the principle of least privilege. Which two additional parameters should they configure to restrict the rule? (Choose two.)

Accepted Answer

Specify the destination IP address of the web server.. To restrict the rule to only the intended web server and application, the team should specify the destination IP address and set the application to 'web-browsing'. These parameters limit the rule's scope to exactly what is needed, following least privilege. Logging, URL category 'any', and changing the source zone do not tighten the rule; they either have no restrictive effect or are incorrect for the scenario.

Answer

Enable logging at session start.

Answer

Set the source zone to 'trust' instead of 'guest'.

Answer

Add a URL category of 'any'.