NetSec-Analyst Policy Creation And Application Practice Test 1 — 15 Questions

Question 1

An administrator needs to ensure that internal users can only access a specific cloud-based SaaS application using their corporate credentials. Which App-ID feature should be utilized in the Security Policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Filters. App-ID control, specifically using the 'App-ID' field combined with 'Application Override' or specific 'Cloud-SaaS' App-ID signatures, ensures granular control over sub-functions of an application.

Answer

App-ID Tagging

Answer

Application Override

Answer

Service Objects

Question 2

You are designing a QoS policy. You want to prioritize VoIP traffic over bulk file transfers. Which component must you create to classify the VoIP traffic?

Accepted Answer

A QoS profile with a specific class and priority.. QoS profiles are applied to QoS policies to define the class and priority of the traffic.

Answer

An App-ID override.

Answer

A Security policy with a QoS tag.

Answer

A Traffic Shaping policy.

Question 3

Which THREE steps are required to correctly implement User-ID mapping using the Windows-based User-ID agent?

Accepted Answer

Install the User-ID agent on a Windows server.. Option B is correct because the Windows-based User-ID agent must be installed on a Windows server (or domain member server) so it can collect user-to-IP mapping data and forward it to the firewall. Option C is correct because User-ID must be enabled on the zone interface (the security zone where the users reside) so the firewall can associate the received mappings with traffic in that zone. Option E is correct because the agent must be configured to monitor Security Event Logs on Domain Controllers to parse Windows logon events (e.g., event IDs 4624) and build the user-to-IP mappings. Option A is incorrect because GlobalProtect is a separate remote-access/VPN solution and is not required for Windows-based User-ID mapping. Option D is incorrect because captive portal is an authentication method for unknown users and is not a required step for implementing User-ID with the Windows agent.

Answer

Install the GlobalProtect agent on all workstations.

Answer

Set the firewall to use a captive portal for all users.

Question 4

When configuring a QoS policy, what is the first step the administrator must take to ensure the traffic is correctly prioritized?

Accepted Answer

Enable QoS on the egress interface. Before QoS can be applied, the traffic must be identified and classified by the QoS policy based on the ingress interface and traffic matching criteria.

Answer

Create a new zone

Answer

Configure NAT policy

Answer

Delete all App-IDs

Question 5

A company is transitioning to a new NAT design. They need to translate traffic from the internal 10.0.0.0/24 network to a specific public IP that is NOT assigned to the firewall interface. Which NAT type is appropriate?

Accepted Answer

Static IP. Destination NAT or static NAT with a specific translation can map internal IPs to a specific external address not bound to the interface.

Answer

Dynamic IP and Port (DIPP)

Answer

Interface-based dynamic IP

Answer

Destination NAT

Question 6

Which TWO settings must be correctly configured to ensure User-ID can properly map an IP address to a user identity in a multi-site environment?

Accepted Answer

IP-User Mapping. Option B (IP-User Mapping) is correct because User-ID fundamentally relies on the IP-to-user mapping table, which is populated by sources such as the User-ID Agent, Terminal Services Agent, or syslog parsing, and this mapping is what allows the firewall to associate a source IP with a specific username in a multi-site environment. Option E (Group Mapping) is correct because mapping users to their directory groups is essential for enforcing policy based on group membership, and without proper group mapping the firewall cannot resolve a user's group affiliations even if the IP-to-user mapping exists. Options A (QoS policy settings) and C (Security policy zones) are not required for the identity mapping process itself; QoS controls bandwidth and zones define traffic segmentation, neither of which populates the User-ID table. Option D (NAT policy configuration) is also not required for User-ID mapping, since NAT affects address translation rather than the user identity resolution mechanism.

Answer

QoS policy settings

Answer

Security policy zones

Answer

NAT policy configuration

Question 7

An administrator configured a security policy with an App-ID of 'web-browsing' and 'ssl', but users cannot access a specific internal portal. The logs show 'ssl' and 'web-browsing' are matched, but the session is dropped. What is the likely cause?

Accepted Answer

The session requires allowing the dependent application explicitly. The firewall requires 'web-browsing' and 'ssl' to be in the policy, but if the application has dependencies, those must also be explicitly allowed.

Answer

The policy lacks the 'web-searching' application dependency

Answer

The application dependency 'web-browsing' is not sufficient for 'ssl'

Answer

The zone protection profile is blocking the traffic

Question 8

To optimize security policy management, an administrator wants to group multiple Security policies together. What feature should be used?

Accepted Answer

Policy Rule Groups. Policy Rulebases can be organized into 'Rule Groups' to help manage and view policies more efficiently.

Answer

Address Groups

Answer

Device Groups

Answer

Service Groups

Question 9

Which security policy action is used to drop traffic without sending a TCP RST or ICMP unreachable message?

Accepted Answer

Deny. The 'Drop' action silently discards the packet, whereas 'Reset' sends a TCP RST or ICMP unreachable.

Answer

Reject

Answer

Allow

Answer

Reset

Question 10

An administrator wants to ensure that all internal traffic to the internet is encrypted. Which policy type would be used to enforce this?

Accepted Answer

Decryption Policy. The Decryption Policy is used to configure SSL Forward Proxy or SSL Inbound Inspection to inspect and enforce encryption requirements.

Answer

NAT Policy

Answer

Security Policy

Answer

QoS Policy

Question 11

Which THREE conditions must be met for a NAT policy to be successfully applied to an incoming packet?

Accepted Answer

Source Zone match. For a NAT policy to match an incoming packet, the firewall evaluates the policy's match criteria against the packet's header and context. Option A (Source Zone match) is correct because the NAT rule must specify the zone from which the traffic originates, and the packet's ingress zone must match that configured source zone. Option C (Destination Zone match) is correct because the NAT rule also requires the destination zone to match the packet's egress zone (or the zone associated with the destination), which is essential for determining how the address translation is applied. Option D (Destination Address match) is correct because the NAT policy must match the original destination IP address (or address object) of the packet before translation occurs. Option B (QoS marking must be set) is incorrect because QoS marking is a separate policy action and is not a condition for NAT policy matching. Option E (User-ID must be enabled) is incorrect because User-ID is an optional identity feature and is not a required match condition for NAT policy application.

Answer

QoS marking must be set

Answer

User-ID must be enabled

Question 12

Which component is required to enable User-ID integration with Microsoft Active Directory using the Windows-based User-ID Agent?

Accepted Answer

A dedicated User-ID Agent. The User-ID Agent acts as a bridge between the Active Directory domain controller and the PAN-OS firewall.

Answer

GlobalProtect

Answer

XML API

Answer

Syslog server

Question 13

An administrator notices that some traffic is not hitting the desired QoS policy. What is the most likely reason?

Accepted Answer

The traffic is not hitting the interface with QoS enabled. If traffic matches a security policy that doesn't have a corresponding QoS marking or the QoS policy matching criteria (zone/interface) is wrong, the traffic will use the default class.

Answer

The session is not SSL

Answer

NAT policy is missing

Answer

The App-ID is not identified

Question 14

Which TWO of the following are true regarding the order of operations for NAT and Security policy evaluation?

Accepted Answer

The Security policy uses the destination zone of the original packet. The firewall evaluates the Security policy based on the pre-NAT zone and address, while NAT is determined based on the packet's destination zone.

Answer

NAT policy is processed before the Security policy

Answer

NAT policy can only match the post-NAT address

Answer

Security policy always ignores the destination zone

Question 15

When adding a security policy, what is the default action if no action is specified?

Accepted Answer

Deny. The default action for new policies is typically 'deny'.

Answer

Allow

Answer

None

Answer

Reset