NetSec-Analyst Object Configuration Creation And Application Practice Test 2 — 15 Questions

Question 1

An administrator is creating a new Application Filter to control access to various applications. They want to include applications that are categorized as 'peer-to-peer' and have a risk level of 4 or higher. They also want to exclude applications that are known to use evasive techniques. Which two configurations should they apply to the Application Filter? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Category to 'peer-to-peer'.. The administrator needs to filter applications by category 'peer-to-peer' and risk level 4 or higher. These two criteria are set directly in the Application Filter. Excluding evasive applications is not directly supported via a characteristic exclusion in the filter; instead, the filter includes applications based on selected attributes. Therefore, the two correct configurations are setting the category and setting the risk.

Answer

Set the Subcategory to 'file-sharing'.

Answer

Set the Characteristics to 'evasive' and mark it as exclude.

Answer

Set the Technology to 'client-server'.

Question 2

A security analyst is creating a new Security Policy rule and needs to reference a specific server by its IP address. The server's IP is 10.1.1.5. The analyst wants to ensure that if the server's IP changes in the future, the policy automatically updates. Which object type should the analyst use?

Accepted Answer

FQDN Address Object. An FQDN Address Object is designed to resolve a hostname to an IP and keep it updated. If the server's IP changes, the firewall will perform DNS resolution and update the object, ensuring the policy remains current. The other object types are static and would not adapt to IP changes.

Answer

Dynamic Address Group

Answer

Address Object with static IP 10.1.1.5

Answer

IP Range Address Object

Question 3

A security analyst is defining a new Service Object in Strata Cloud Manager to represent a custom application that uses TCP port 8443 for management and UDP port 8443 for data. The application also requires ICMP echo requests for health checks. The analyst wants to minimize the number of objects while ensuring the policy matches all required traffic. Which configuration should the analyst use?

Accepted Answer

Create a Service Group that contains one Service Object for TCP port 8443, one for UDP port 8443, and one for ICMP.. Service Groups allow multiple Service Objects to be combined into a single reference for policy. Since each Service Object defines a single protocol and port, the analyst must create separate objects for TCP 8443, UDP 8443, and ICMP, then place them in a Service Group. This satisfies the requirement to match all traffic while keeping the policy rule concise and manageable.

Answer

Create a single Service Object with protocol TCP and UDP, destination port 8443, and a separate Service Object for ICMP; then group them in a Service Group.

Answer

Create a single Service Object with protocol TCP, destination port 8443; then create a separate Service Object for UDP port 8443 and a third for ICMP. Group them in a Service Group.

Answer

Create a single Service Object with protocol TCP, destination port 8443, and add a second destination port for UDP 8443 in the same object.

Question 4

A security analyst is configuring a new Service Object for a custom application that uses UDP port 500 and 4500 for IPsec NAT-T. The analyst wants to ensure the firewall correctly identifies and allows this traffic. Which configuration is required?

Accepted Answer

Create a Service Object with protocol UDP and destination ports 500,4500.. IPsec NAT-T uses UDP ports 500 and 4500. A Service Object must be configured with the UDP protocol and these destination ports to correctly match the traffic. This allows the firewall to identify the service and apply security policy. Using TCP or an Application Object would not be appropriate for this scenario.

Answer

Create a Service Object with protocol TCP and destination ports 500,4500.

Answer

Create a Service Group that includes UDP 500 and UDP 4500.

Answer

Create an Application Object with protocol UDP and ports 500,4500.

Question 5

You are configuring an Address Object in Strata Cloud Manager for a new web server. Which field must be unique within the configuration scope?

Accepted Answer

Object Name. The name field of an object must be unique within its context (Device Group or Snippet) to prevent configuration conflicts.

Answer

Tag

Answer

IP Netmask

Answer

Description

Question 6

You are troubleshooting a policy that fails to match traffic for a group of servers. The servers are represented by an Address Group. What is the most likely cause if the Address Group is dynamic?

Accepted Answer

The dynamic filter does not match the tags assigned to the intended objects. A dynamic address group uses tag-based registration to populate its membership. If the tags on the underlying objects do not match the filter, the group remains empty.

Answer

The objects are in a different Device Group

Answer

The group does not have a description

Answer

The static members were not added manually

Question 7

You want to color-code objects in Strata Cloud Manager to improve visibility. Which feature do you use?

Accepted Answer

Tags. Tags are used to provide metadata, including colors, to objects for better organization and visual identification.

Answer

Device Groups

Answer

Descriptions

Answer

Object Filtering

Question 8

Which feature allows you to group multiple Address Objects together to simplify Security Policy management?

Accepted Answer

Address Group. Address Groups allow administrators to bundle multiple individual address objects into a single logical entity.

Answer

Tagging

Answer

Address Object Registry

Answer

Snippet

Question 9

Which object type would you use to define a range of IP addresses (e.g., 10.1.1.1 to 10.1.1.50) in PAN-OS?

Accepted Answer

IP Range. An IP Range object is specifically designed to cover a non-CIDR block range of IP addresses.

Answer

IP Netmask

Answer

FQDN

Answer

Address Group

Question 10

When using a Dynamic Address Group (DAG) in a policy, what is the prerequisite for the traffic to match the intended members?

Accepted Answer

The objects must be tagged with the value defined in the DAG filter. Objects must be registered with the specific tag that the DAG filter is searching for.

Answer

The objects must be in the same subnet

Answer

The objects must have a static IP

Answer

The objects must be added to a static group first

Question 11

You need to create a service object for a legacy application that uses a custom TCP port 8888. How should this be defined in PAN-OS?

Accepted Answer

Define a Service object specifying Protocol TCP and Destination Port 8888. Service objects require specifying the protocol (TCP/UDP) and the specific port or port range required by the application.

Answer

Create an Address object for the port

Answer

Create a Service Group with port 8888

Answer

Use an Application Override policy

Question 12

Which object category is used to group various network services to simplify policy definitions?

Accepted Answer

Service Group. Service Groups are used to bundle individual service objects together.

Answer

Tag Group

Answer

Address Group

Answer

Profile Group

Question 13

Which of the following is NOT a valid type of address object?

Accepted Answer

IP Protocol. Palo Alto Networks supports IP Netmask, IP Range, and FQDN objects. IP Protocol is not an address object type.

Answer

FQDN

Answer

IP Netmask

Answer

IP Range

Question 14

You are migrating configurations to Strata Cloud Manager. What is the benefit of using Snippets?

Accepted Answer

They allow for reusable configuration templates across device groups. Snippets allow for the creation of reusable configuration templates that can be pushed to multiple device groups.

Answer

They are only for firewall hardware settings

Answer

They automatically detect viruses

Answer

They replace the need for security policies

Question 15

An administrator needs to exclude a specific server from a Dynamic Address Group that uses a filter for all 'Production' tagged servers. What is the most efficient way to achieve this?

Accepted Answer

Use a negative tag in the DAG filter (e.g., 'Production' AND NOT 'Exclude'). The filter expression in a DAG supports logical operators, allowing the exclusion of specific tags or criteria.

Answer

Change the IP address of the server

Answer

Remove the server from the network

Answer

Manually delete the object