NetSec-Analyst Policy Creation And Application Practice Test 3 — 15 Questions

Question 1

A NetSec-Analyst is reviewing a firewall policy and notices that a security rule allows traffic from the trust zone to the untrust zone using the application 'ssl' but does not specify any service. A user reports that HTTPS access to a new external website is failing, even though the rule is present. What is the most likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application 'ssl' is a dependent application and requires the 'web-browsing' application to be allowed as well for proper HTTPS access.. The 'ssl' application often depends on 'web-browsing' to function fully. Allowing only 'ssl' can block parts of the HTTPS session that require web-browsing, causing access failures. Adding 'web-browsing' to the security rule ensures both applications are permitted, resolving the issue. The other options misstate how application identification works or incorrectly claim direction or service limitations.

Answer

The security rule must specify a service object for HTTPS (TCP 443) because the application 'ssl' only matches the handshake and not the data transfer.

Answer

The 'ssl' application is only for outbound traffic and cannot be used for inbound traffic from the untrust zone to the trust zone.

Answer

The 'ssl' application does not cover all HTTPS traffic because it is limited to specific TLS versions, and the new website uses a newer version that is not recognized.

Question 2

A security analyst is creating a security policy on a Palo Alto Networks firewall to allow internal users to access a web server in a DMZ. The analyst wants to ensure that the policy only allows HTTP and HTTPS traffic to that specific server, and that all other traffic is denied. Which two objects should be used in the security policy to achieve this?

Accepted Answer

An address object for the server and an application filter containing 'web-browsing' and 'ssl'.. To allow only HTTP and HTTPS to a specific server, the policy should use an address object for the destination server and an application filter containing 'web-browsing' and 'ssl'. This restricts both destination and application. Service objects only restrict ports, not applications, and URL categories are for web filtering. The combination of address object and application filter provides the necessary least privilege.

Answer

An application group with 'web-browsing' and 'ssl' and a static address object for the server.

Answer

A URL category object for 'web-browsing' and a dynamic address group for the server.

Answer

A service object for TCP 80 and 443 and an address group for the internal users.

Question 3

A security administrator is creating a Security Policy rule on a Palo Alto Networks firewall to block traffic from the 'Guest' zone to the 'Internal' zone. The administrator wants to ensure that all traffic from Guest to Internal is denied, but also wants to log the denied traffic for auditing purposes. Which action should be configured in the Security Policy rule to achieve this?

Accepted Answer

Set the Action to 'Deny' and enable logging at session end.. To block and log traffic, the administrator should set the Action to 'Deny' and enable logging at session end. This configuration denies the traffic and generates a log entry for each denied session, which can be used for auditing. Other actions like 'Allow' would permit traffic, and 'Drop' with session start logging is not the standard approach for logging denied sessions.

Answer

Set the Action to 'Allow' and enable logging at session end.

Answer

Set the Action to 'Deny' and enable logging at session start.

Answer

Set the Action to 'Drop' and enable logging at session start.

Question 4

A security analyst is configuring a security policy to allow access to a web server in the DMZ from the internet. The web server's real IP address is 10.1.1.10, and it is published via a public IP address 203.0.113.5 using destination NAT. The analyst wants to ensure that the security policy matches the correct zone and address. Which source and destination zones should be used in the security policy?

Accepted Answer

Source zone: untrust, Destination zone: DMZ. The security policy must use the post-NAT destination zone, which is DMZ, because destination NAT translates the public IP to the web server's real IP in the DMZ before policy evaluation. The source zone remains untrust as the traffic comes from the internet. Therefore, the correct zones are untrust to DMZ. This ensures the policy matches the translated traffic and enforces the intended access control.

Answer

Source zone: untrust, Destination zone: untrust

Answer

Source zone: trust, Destination zone: DMZ

Answer

Source zone: untrust, Destination zone: any

Question 5

A NetSec-Analyst is reviewing a Security Policy that allows traffic from the trust zone to the untrust zone. The policy uses the application 'ssl' and the service 'application-default'. Users report that they cannot access a specific external website that uses a non-standard SSL port. What is the most likely cause of the issue?

Accepted Answer

The service 'application-default' only allows the default port for the application, which is TCP 443 for 'ssl', so the non-standard port is blocked.. The service 'application-default' restricts traffic to the default port for the specified application. For 'ssl', the default port is TCP 443. If the external website uses a non-standard SSL port, the traffic will not match the default port and will be blocked. To allow the non-standard port, the analyst should change the service to 'any' or create a custom service object for that port, ensuring the Security Policy rule permits the traffic.

Answer

The application 'ssl' is not compatible with the untrust zone, so traffic is blocked regardless of port.

Answer

The application 'ssl' only matches traffic on TCP port 443, so the non-standard port is not allowed.

Answer

The Security Policy rule is missing a URL category, so the firewall cannot identify the website and blocks it.

Question 6

Which TWO methods can be used to identify traffic using App-ID when port-based rules are insufficient?

Accepted Answer

Behavioral analysis of the traffic flow.. Option A is correct because App-ID can identify applications through behavioral analysis, observing session characteristics such as packet timing, payload sizes, and flow patterns to distinguish applications that cannot be reliably separated by port alone. Option C is correct because App-ID relies on Deep Packet Inspection (DPI) signatures that match application-specific protocol patterns and payload content, which is exactly how it identifies traffic when port-based rules are insufficient. Options B, D, and E do not belong: IP address reputation filtering and MAC address filtering identify hosts or devices rather than applications, and URL filtering categories classify web destinations rather than the application generating the traffic.

Answer

IP address reputation filtering.

Answer

MAC address filtering.

Answer

URL filtering categories.

Question 7

An administrator needs to allow traffic from the internal network to a public web server using Source NAT. Which configuration is required to ensure the internal client IP is translated to the firewall's public interface IP?

Accepted Answer

Configure a Dynamic IP and Port translation using the interface address.. Dynamic IP and Port translation (DIPP) is the standard method for mapping internal IPs to an interface IP.

Answer

Configure a U-Turn NAT policy.

Answer

Configure a Destination NAT policy.

Answer

Configure a Static NAT policy.

Question 8

You are configuring a Security policy to allow web traffic. Why should you place the most specific rules at the top of the Security policy list?

Accepted Answer

To ensure the most specific criteria are matched before a broader rule captures the traffic.. Palo Alto Networks firewalls evaluate policies from top to bottom and stop at the first match.

Answer

To reduce the size of the rulebase configuration file.

Answer

To improve hardware CPU performance.

Answer

To comply with the zone-based architecture requirements.

Question 9

A user is unable to access a web application. The security policy log shows the traffic is hitting the default 'deny' rule. What is the most effective way to troubleshoot the App-ID identification?

Accepted Answer

Analyze the Traffic Log for the specific session. Checking the Traffic Log and looking at the 'App-ID' column shows what the firewall identified the traffic as; if it shows 'incomplete' or 'unknown-tcp', that identifies the issue.

Answer

Check the Threat Log

Answer

Restart the management plane

Answer

Clear the session table

Question 10

Which TWO options describe valid ways to handle traffic that is identified as 'unknown-tcp' in a security policy?

Accepted Answer

Use an Application Override policy. Option A is correct because an Application Override policy lets you force traffic that the firewall cannot identify (such as unknown-tcp) to be treated as a specific application on a specified port, giving you control over how that traffic is handled in the security policy. Option D is correct because creating a custom App-ID allows you to define signatures for the unidentified application so the firewall can properly recognize and classify the unknown-tcp traffic, after which normal security policy rules can match it. Option B is incorrect because changing the zone to 'Internal' does not affect application identification and is not a valid method for handling unknown-tcp traffic. Option C is incorrect because disabling NAT has no bearing on how the firewall identifies or processes unknown-tcp sessions. Option E is incorrect because enabling QoS on an interface only affects bandwidth and prioritization, not the identification or policy handling of unknown-tcp traffic.

Answer

Change the zone to 'Internal'

Answer

Disable NAT

Answer

Enable QoS on the interface

Question 11

When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?

Accepted Answer

Translated Address. In a NAT policy, the Translated Address field (sometimes labeled 'Translated Packet' or 'NAT Translated Address') specifies the IP address that the original source or destination is rewritten to. For destination NAT (DNAT), this is the internal address that external traffic is redirected to; for source NAT (SNAT), it is the public address outbound traffic appears to come from. The field name explicitly describes the post-translation address.

Answer

Destination Address

Answer

Service Port

Answer

Source Address

Question 12

What is the function of an 'Application Group' in PAN-OS policy creation?

Accepted Answer

To bundle multiple applications for use in a single policy rule. Application Groups allow grouping multiple applications into a single object, simplifying policy creation.

Answer

To apply QoS markings to specific apps

Answer

To define the port for the application

Answer

To map users to applications

Question 13

Which tab in the Palo Alto Networks GUI is primarily used to manage Security and NAT policies?

Accepted Answer

Policies. The 'Policies' tab is the central location for managing all types of policies.

Answer

Objects

Answer

Monitor

Answer

Network

Question 14

Which THREE items can be used as a match criterion in a Security Policy?

Accepted Answer

Source User. In a Palo Alto Networks Security Policy, the match criteria (the "Source" and "Destination" tabs plus the "Application" and "User" fields) include Source User (A), which matches traffic based on the user or group identified via User-ID, and Application (C), which matches the specific application or application group identified by App-ID. Source Zone (D) is also a valid match criterion, matching the ingress security zone from which the session originates. QoS Profile Name (B) is not a match criterion; QoS is applied as an action/classifier on the rule, not used to select traffic. NAT Pool (E) is likewise not a match criterion; NAT pools are referenced in NAT policy rules for source or destination translation, not in Security Policy matching.

Answer

QoS Profile Name

Answer

NAT Pool

Question 15

A policy rule is configured for 'web-browsing' and 'ssl', but the traffic is being dropped. The logs indicate the application is 'google-base'. What is the most appropriate fix?

Accepted Answer

Add 'google-base' to the policy. Since 'google-base' is a distinct App-ID from 'web-browsing', the policy must either be updated to include 'google-base' or use an application filter.

Answer

Change the service to 'any'

Answer

Disable App-ID

Answer

Create an Application Override