NetSec-Analyst Policy Creation And Application Practice Test 2 — 15 Questions

Question 1

An administrator needs to perform NAT for a server that is in a DMZ but accessed via the public internet. Which NAT rule type is used for this?

Accepted Answer

Destination NAT. Destination NAT is used to allow inbound access from the internet to an internal server by mapping a public address to a private one.

Answer

Source NAT

Answer

Dynamic NAT

Answer

Static NAT

Question 2

Which TWO items must be matched in a QoS policy?

Accepted Answer

Source Zone. In a QoS policy, traffic must be classified by matching a Source Zone (option A) and an App-ID (option D), because QoS rules are built on the same zone-based and application-aware matching framework used elsewhere in the firewall, allowing the policy to identify which traffic entering from a given zone and belonging to a specific application should receive the defined bandwidth/priority treatment. Source Zone is required to scope the policy to traffic originating from a particular security zone, and App-ID is required to identify the application so that QoS actions such as guaranteed bandwidth, maximum bandwidth, or priority can be applied to that application's traffic. The other options do not belong: a Security Profile (B) is used for threat/content inspection in security policy rules, not for QoS classification; a NAT Pool (C) is used for source or destination NAT address translation, not QoS matching; and a User Group (E) is an optional source-user criterion in security policy, not a required match condition for a QoS policy.

Answer

Security Profile

Answer

NAT Pool

Answer

User Group

Question 3

Which THREE components are required for an Application Override policy?

Accepted Answer

Protocol and Port. An Application Override policy in PAN-OS requires three elements: the Protocol and Port (B) to define the exact traffic signature to match, the Application name (C) to specify which application the matched traffic should be identified as, and the Source and Destination Zone (E) to scope where the override applies. Protocol and Port (B) is essential because Application Override matches on a custom port/protocol combination rather than App-ID signatures. Application name (C) is required because the purpose of the override is to force traffic to be recognized as a specific application. Source and Destination Zone (E) is required because every security policy rule, including Application Override, must define zones to determine direction and scope of the match. User Group (A) is not required since Application Override rules do not use user/group as a matching criterion, and QoS profile (D) is unrelated because QoS is applied via QoS policy, not Application Override.

Answer

User Group

Answer

QoS profile

Question 4

Which THREE criteria are used to determine which security policy rule a packet matches?

Accepted Answer

Source Zone. The firewall matches packets based on source zone, destination zone, and source/destination addresses in a specific order defined in the policy base.

Answer

QoS class

Answer

NAT rule

Question 5

Which TWO steps are required to ensure that the firewall can map IPs to users using the User-ID Agent?

Accepted Answer

Configure the User-ID agent in the Device tab. You must configure the User-ID Agent and then enable 'User Identification' on the relevant interface in the firewall settings.

Answer

Set up a QoS policy

Answer

Assign a static IP to the AD server

Answer

Create a NAT rule for AD traffic

Question 6

Which feature allows the administrator to view which policy a packet hit in real-time?

Accepted Answer

Traffic Log. The 'Policy Optimizer' or the 'Traffic Log' with the 'Rule' column visible allows identifying which rule was matched.

Answer

QoS Stats

Answer

Device Monitor

Answer

Test Policy

Question 7

Which field in a security policy should be checked to verify if logging is enabled?

Accepted Answer

Options tab. The 'Options' tab of the Security Policy contains the 'Log at Session End' and 'Log at Session Start' checkboxes.

Answer

Source tab

Answer

General tab

Answer

Service tab

Question 8

Which THREE actions can be applied to a Security Policy rule?

Accepted Answer

Reset. In a firewall Security Policy rule, the action field determines how matching traffic is handled, and the three valid actions here are Reset (A), Allow (D), and Deny (E). Allow (D) permits the matching traffic to pass through the firewall, which is the standard permit action for trusted or authorized flows. Deny (E) silently drops the matching traffic without notifying the sender, which is used to block unwanted sessions. Reset (A) rejects the matching traffic by sending a TCP RST (or ICMP unreachable for non-TCP), actively terminating the connection rather than silently dropping it. The remaining options do not belong: Redirect (B) is not a Security Policy rule action (it is associated with other features such as decryption or captive portal/URL filtering behaviors), and Encrypt (C) is not a rule action but rather a function of VPN or decryption policy handling.

Answer

Redirect

Answer

Encrypt

Question 9

Why might an Application Override policy be preferred over a Security Policy for a specific custom application?

Accepted Answer

To identify custom traffic that App-ID fails to detect. When an application is proprietary or custom and the firewall cannot identify it using standard App-ID, an Application Override policy lets you manually classify that traffic as a specific application. This allows Security Policy (and other policy types) to match and control the traffic based on that classification, rather than leaving it unidentified.

Answer

To enable NAT

Answer

To increase security

Answer

To enable QoS

Question 10

A user is accessing an application, but the traffic is logged as 'unknown-udp'. What is the recommended way to secure this without allowing all UDP traffic?

Accepted Answer

Create a custom App-ID. Create a custom App-ID that identifies the traffic pattern, or if it is a standard custom service, use an Application Override if you have identified the port/protocol, but a custom App-ID is the best way to keep L7 visibility.

Answer

Disable all UDP traffic

Answer

Use a Service object for the port

Answer

Allow all UDP traffic

Question 11

An administrator is configuring a Security Policy rule on a Palo Alto Networks firewall. The rule is intended to allow only outbound DNS queries from the internal network to any external DNS server. The administrator wants to ensure that only DNS traffic is permitted, regardless of the port used by the application. Which combination of settings should be used in the Security Policy rule to achieve this requirement?

Accepted Answer

Set the Application to 'dns' and the Service to 'application-default'.. The correct approach is to use the Application 'dns' and set Service to 'application-default'. This allows the firewall to enforce the standard ports associated with DNS, ensuring that only DNS traffic is permitted and that it uses the expected ports. Using 'any' for either field would broaden the rule unnecessarily, while a custom service object duplicates built-in functionality.

Answer

Set the Application to 'dns' and the Service to 'any'.

Answer

Set the Application to 'dns' and create a custom Service object for UDP/TCP 53.

Answer

Set the Application to 'any' and the Service to 'dns'.

Question 12

An analyst reviews a rulebase where a security policy permits 'any' application for the 'Trust' zone to the 'Untrust' zone. The organization wants to tighten this without breaking business traffic. Which NetSec-Analyst-aligned policy principle should be applied FIRST?

Accepted Answer

Implement a default-deny posture and explicitly allow only required applications.. The correct approach is to move from an implicit allow-any rule to an explicit default-deny model with documented allows. This embodies least privilege and is the foundational step in tightening a rulebase. Logging, QoS, and URL filtering are useful adjuncts but do not themselves reduce the permitted application surface, so they cannot be the first action when the goal is policy tightening.

Answer

Enable logging on the existing 'any' rule to gather baseline traffic data.

Answer

Add a URL filtering profile to the 'any' rule to block malicious destinations.

Answer

Create a QoS policy to prioritize business-critical applications over the 'any' rule.

Question 13

A network security analyst is investigating why a security policy that should block peer-to-peer file sharing is not working. The policy is configured with the application 'bittorrent' and action 'deny'. However, users are still able to download torrents. The analyst suspects that the traffic is being identified as a different application. Which TWO actions should the analyst take to ensure the policy effectively blocks peer-to-peer traffic? (Choose two.)

Accepted Answer

Add the application 'bittorrent' to the policy and also enable decryption for the traffic to allow App-ID to inspect the payload.. To block BitTorrent effectively, the firewall must be able to identify it even when encrypted, which requires decryption. Additionally, denying unknown-tcp and ssl ensures that traffic that cannot be positively identified as allowed is blocked, preventing evasion. These two actions together close the gaps that allow torrent traffic to bypass the bittorrent deny rule.

Answer

Disable App-ID on the firewall and revert to port-based rules for all traffic.

Answer

Add a service object for the default BitTorrent port range and deny that service.

Answer

Change the policy action to 'allow' and rely on URL filtering to block torrent sites.

Question 14

A security administrator is configuring a new firewall rule to allow web access for employees. The administrator wants to ensure that the rule only allows HTTP and HTTPS traffic, and that all other applications are blocked. Which type of object should the administrator use in the security policy to achieve this with the least administrative effort?

Accepted Answer

Application IDs for 'web-browsing' and 'ssl'. Using Application IDs 'web-browsing' and 'ssl' allows the firewall to identify and control web traffic based on application signatures, not just ports. This ensures that only web browsing and SSL-encrypted traffic are allowed, while other applications are blocked. It is the most precise and least administrative effort because it leverages App-ID.

Answer

Application Group containing 'web-browsing' and 'ssl'

Answer

Application Filter with a category of 'web-browsing'

Answer

Service object for TCP ports 80 and 443

Question 15

A security analyst is designing a policy for a new branch office that uses a Palo Alto Networks firewall. The branch has a single internet connection and a single internal zone. The analyst wants to ensure that outbound traffic to the internet is inspected for threats and that any traffic destined to the corporate headquarters is sent through an IPsec tunnel. Which TWO policy components must be configured to achieve this? (Choose two.)

Accepted Answer

A security policy from the internal zone to the internet zone with a security profile group applied.. To inspect internet-bound traffic, a security policy with a security profile group is needed. To send traffic through an IPsec tunnel to headquarters, a security policy allowing the IPsec application between the internal and VPN zones is required. NAT, QoS, and decryption are not mandatory for these specific objectives.

Answer

A NAT policy that translates all internal IP addresses to the firewall's external IP address for internet-bound traffic.

Answer

A decryption policy that decrypts all outbound SSL traffic to the internet.

Answer

A QoS policy that prioritizes IPsec traffic over other outbound traffic.