NetSec-Analyst Policy Creation And Application — 30 Questions

Question 1

An administrator needs to ensure that internal users can only access a specific cloud-based SaaS application using their corporate credentials. Which App-ID feature should be utilized in the Security Policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Filters. App-ID control, specifically using the 'App-ID' field combined with 'Application Override' or specific 'Cloud-SaaS' App-ID signatures, ensures granular control over sub-functions of an application.

Answer

App-ID Tagging

Answer

Application Override

Answer

Service Objects

Question 2

You are designing a QoS policy. You want to prioritize VoIP traffic over bulk file transfers. Which component must you create to classify the VoIP traffic?

Accepted Answer

A QoS profile with a specific class and priority.. QoS profiles are applied to QoS policies to define the class and priority of the traffic.

Answer

An App-ID override.

Answer

A Security policy with a QoS tag.

Answer

A Traffic Shaping policy.

Question 3

Which THREE steps are required to correctly implement User-ID mapping using the Windows-based User-ID agent?

Accepted Answer

Install the User-ID agent on a Windows server.. Option B is correct because the Windows-based User-ID agent must be installed on a Windows server (or domain member server) so it can collect user-to-IP mapping data and forward it to the firewall. Option C is correct because User-ID must be enabled on the zone interface (the security zone where the users reside) so the firewall can associate the received mappings with traffic in that zone. Option E is correct because the agent must be configured to monitor Security Event Logs on Domain Controllers to parse Windows logon events (e.g., event IDs 4624) and build the user-to-IP mappings. Option A is incorrect because GlobalProtect is a separate remote-access/VPN solution and is not required for Windows-based User-ID mapping. Option D is incorrect because captive portal is an authentication method for unknown users and is not a required step for implementing User-ID with the Windows agent.

Answer

Install the GlobalProtect agent on all workstations.

Answer

Set the firewall to use a captive portal for all users.

Question 4

When configuring a QoS policy, what is the first step the administrator must take to ensure the traffic is correctly prioritized?

Accepted Answer

Enable QoS on the egress interface. Before QoS can be applied, the traffic must be identified and classified by the QoS policy based on the ingress interface and traffic matching criteria.

Answer

Create a new zone

Answer

Configure NAT policy

Answer

Delete all App-IDs

Question 5

A company is transitioning to a new NAT design. They need to translate traffic from the internal 10.0.0.0/24 network to a specific public IP that is NOT assigned to the firewall interface. Which NAT type is appropriate?

Accepted Answer

Static IP. Destination NAT or static NAT with a specific translation can map internal IPs to a specific external address not bound to the interface.

Answer

Dynamic IP and Port (DIPP)

Answer

Interface-based dynamic IP

Answer

Destination NAT

Question 6

Which TWO settings must be correctly configured to ensure User-ID can properly map an IP address to a user identity in a multi-site environment?

Accepted Answer

IP-User Mapping. Option B (IP-User Mapping) is correct because User-ID fundamentally relies on the IP-to-user mapping table, which is populated by sources such as the User-ID Agent, Terminal Services Agent, or syslog parsing, and this mapping is what allows the firewall to associate a source IP with a specific username in a multi-site environment. Option E (Group Mapping) is correct because mapping users to their directory groups is essential for enforcing policy based on group membership, and without proper group mapping the firewall cannot resolve a user's group affiliations even if the IP-to-user mapping exists. Options A (QoS policy settings) and C (Security policy zones) are not required for the identity mapping process itself; QoS controls bandwidth and zones define traffic segmentation, neither of which populates the User-ID table. Option D (NAT policy configuration) is also not required for User-ID mapping, since NAT affects address translation rather than the user identity resolution mechanism.

Answer

QoS policy settings

Answer

Security policy zones

Answer

NAT policy configuration

Question 7

An administrator configured a security policy with an App-ID of 'web-browsing' and 'ssl', but users cannot access a specific internal portal. The logs show 'ssl' and 'web-browsing' are matched, but the session is dropped. What is the likely cause?

Accepted Answer

The session requires allowing the dependent application explicitly. The firewall requires 'web-browsing' and 'ssl' to be in the policy, but if the application has dependencies, those must also be explicitly allowed.

Answer

The policy lacks the 'web-searching' application dependency

Answer

The application dependency 'web-browsing' is not sufficient for 'ssl'

Answer

The zone protection profile is blocking the traffic

Question 8

To optimize security policy management, an administrator wants to group multiple Security policies together. What feature should be used?

Accepted Answer

Policy Rule Groups. Policy Rulebases can be organized into 'Rule Groups' to help manage and view policies more efficiently.

Answer

Address Groups

Answer

Device Groups

Answer

Service Groups

Question 9

Which security policy action is used to drop traffic without sending a TCP RST or ICMP unreachable message?

Accepted Answer

Deny. The 'Drop' action silently discards the packet, whereas 'Reset' sends a TCP RST or ICMP unreachable.

Answer

Reject

Answer

Allow

Answer

Reset

Question 10

An administrator wants to ensure that all internal traffic to the internet is encrypted. Which policy type would be used to enforce this?

Accepted Answer

Decryption Policy. The Decryption Policy is used to configure SSL Forward Proxy or SSL Inbound Inspection to inspect and enforce encryption requirements.

Answer

NAT Policy

Answer

Security Policy

Answer

QoS Policy

Question 11

Which THREE conditions must be met for a NAT policy to be successfully applied to an incoming packet?

Accepted Answer

Source Zone match. For a NAT policy to match an incoming packet, the firewall evaluates the policy's match criteria against the packet's header and context. Option A (Source Zone match) is correct because the NAT rule must specify the zone from which the traffic originates, and the packet's ingress zone must match that configured source zone. Option C (Destination Zone match) is correct because the NAT rule also requires the destination zone to match the packet's egress zone (or the zone associated with the destination), which is essential for determining how the address translation is applied. Option D (Destination Address match) is correct because the NAT policy must match the original destination IP address (or address object) of the packet before translation occurs. Option B (QoS marking must be set) is incorrect because QoS marking is a separate policy action and is not a condition for NAT policy matching. Option E (User-ID must be enabled) is incorrect because User-ID is an optional identity feature and is not a required match condition for NAT policy application.

Answer

QoS marking must be set

Answer

User-ID must be enabled

Question 12

Which component is required to enable User-ID integration with Microsoft Active Directory using the Windows-based User-ID Agent?

Accepted Answer

A dedicated User-ID Agent. The User-ID Agent acts as a bridge between the Active Directory domain controller and the PAN-OS firewall.

Answer

GlobalProtect

Answer

XML API

Answer

Syslog server

Question 13

An administrator notices that some traffic is not hitting the desired QoS policy. What is the most likely reason?

Accepted Answer

The traffic is not hitting the interface with QoS enabled. If traffic matches a security policy that doesn't have a corresponding QoS marking or the QoS policy matching criteria (zone/interface) is wrong, the traffic will use the default class.

Answer

The session is not SSL

Answer

NAT policy is missing

Answer

The App-ID is not identified

Question 14

Which TWO of the following are true regarding the order of operations for NAT and Security policy evaluation?

Accepted Answer

The Security policy uses the destination zone of the original packet. The firewall evaluates the Security policy based on the pre-NAT zone and address, while NAT is determined based on the packet's destination zone.

Answer

NAT policy is processed before the Security policy

Answer

NAT policy can only match the post-NAT address

Answer

Security policy always ignores the destination zone

Question 15

When adding a security policy, what is the default action if no action is specified?

Accepted Answer

Deny. The default action for new policies is typically 'deny'.

Answer

Allow

Answer

None

Answer

Reset

Question 16

An administrator needs to perform NAT for a server that is in a DMZ but accessed via the public internet. Which NAT rule type is used for this?

Accepted Answer

Destination NAT. Destination NAT is used to allow inbound access from the internet to an internal server by mapping a public address to a private one.

Answer

Source NAT

Answer

Dynamic NAT

Answer

Static NAT

Question 17

Which TWO items must be matched in a QoS policy?

Accepted Answer

Source Zone. In a QoS policy, traffic must be classified by matching a Source Zone (option A) and an App-ID (option D), because QoS rules are built on the same zone-based and application-aware matching framework used elsewhere in the firewall, allowing the policy to identify which traffic entering from a given zone and belonging to a specific application should receive the defined bandwidth/priority treatment. Source Zone is required to scope the policy to traffic originating from a particular security zone, and App-ID is required to identify the application so that QoS actions such as guaranteed bandwidth, maximum bandwidth, or priority can be applied to that application's traffic. The other options do not belong: a Security Profile (B) is used for threat/content inspection in security policy rules, not for QoS classification; a NAT Pool (C) is used for source or destination NAT address translation, not QoS matching; and a User Group (E) is an optional source-user criterion in security policy, not a required match condition for a QoS policy.

Answer

Security Profile

Answer

NAT Pool

Answer

User Group

Question 18

Which THREE components are required for an Application Override policy?

Accepted Answer

Protocol and Port. An Application Override policy in PAN-OS requires three elements: the Protocol and Port (B) to define the exact traffic signature to match, the Application name (C) to specify which application the matched traffic should be identified as, and the Source and Destination Zone (E) to scope where the override applies. Protocol and Port (B) is essential because Application Override matches on a custom port/protocol combination rather than App-ID signatures. Application name (C) is required because the purpose of the override is to force traffic to be recognized as a specific application. Source and Destination Zone (E) is required because every security policy rule, including Application Override, must define zones to determine direction and scope of the match. User Group (A) is not required since Application Override rules do not use user/group as a matching criterion, and QoS profile (D) is unrelated because QoS is applied via QoS policy, not Application Override.

Answer

User Group

Answer

QoS profile

Question 19

Which THREE criteria are used to determine which security policy rule a packet matches?

Accepted Answer

Source Zone. The firewall matches packets based on source zone, destination zone, and source/destination addresses in a specific order defined in the policy base.

Answer

QoS class

Answer

NAT rule

Question 20

Which TWO steps are required to ensure that the firewall can map IPs to users using the User-ID Agent?

Accepted Answer

Configure the User-ID agent in the Device tab. You must configure the User-ID Agent and then enable 'User Identification' on the relevant interface in the firewall settings.

Answer

Set up a QoS policy

Answer

Assign a static IP to the AD server

Answer

Create a NAT rule for AD traffic