NetSec-Analyst Policy Creation And Application Practice Test 4 — 15 Questions

Question 1

If an administrator wants to ensure that a specific server can only be accessed from a specific internal subnet, where is this best configured?

Accepted Answer

Security Policy. The Security Policy is the correct place to enforce source-to-destination-to-application access control.

Answer

Decryption Policy

Answer

NAT Policy

Answer

QoS Policy

Question 2

Which configuration menu allows you to define an address object?

Accepted Answer

Objects > Addresses. Address objects are defined under 'Objects' > 'Addresses'.

Answer

Device > Setup

Answer

Network > Interfaces

Answer

Policies > Security

Question 3

Which THREE features are associated with an 'Application Filter'?

Accepted Answer

Technology. Application Filters group applications based on category, subcategory, and technology, and these filters update automatically as new applications are added to the PAN-OS database.

Answer

Destination port

Answer

Source IP address

Question 4

An administrator wants to permit traffic based on a specific User-ID group. Where should this group be referenced in the Security Policy?

Accepted Answer

Source User. The 'Source User' field in the security policy is where groups are added to permit/deny traffic.

Answer

Application

Answer

Service

Answer

Destination Address

Question 5

What is the purpose of the 'Service' field in a Security Policy?

Accepted Answer

To define the port. The 'Service' field specifies the TCP/UDP ports to be allowed or denied, though App-ID is preferred.

Answer

To define the NAT rule

Answer

To define the application

Answer

To define the user

Question 6

When configuring App-ID, how does the firewall identify traffic?

Accepted Answer

By deep packet inspection and protocol analysis. App-ID uses packet inspection (signatures, heuristics, and protocol decoders) to identify applications.

Answer

Only by IP address

Answer

Only by port

Answer

By user identity only

Question 7

An organization has a strict requirement that all web traffic must be inspected. Which policy is required in addition to the Security policy to achieve this?

Accepted Answer

Decryption Policy. Decryption policy is necessary for the firewall to see inside SSL/TLS traffic.

Answer

Device Policy

Answer

NAT Policy

Answer

QoS Policy

Question 8

What is the result of applying a 'Log at Session End' setting in a security policy?

Accepted Answer

Record log when the connection closes. Logging at session end ensures a summary of the session (bytes transferred, duration) is recorded when the session terminates.

Answer

Bypass security

Answer

Log every packet

Answer

Deny all traffic

Question 9

Which object type should be used when you want to group several address objects together?

Accepted Answer

Address Group. An 'Address Group' allows for grouping multiple address objects for easier policy management.

Answer

Service Group

Answer

Zone

Answer

Interface

Question 10

An administrator wants to prioritize VoIP traffic over all other traffic. Which policy type is the best choice?

Accepted Answer

QoS Policy. QoS policy allows classifying and prioritizing traffic based on class settings and interface bandwidth.

Answer

Security Policy

Answer

NAT Policy

Answer

Decryption Policy

Question 11

Which THREE settings must be configured to allow inbound NAT traffic for a web server?

Accepted Answer

Security policy. You need a NAT policy, a security policy allowing traffic from the external zone to the DMZ, and a properly configured destination NAT address mapping.

Answer

QoS policy

Answer

App-ID override

Question 12

What is the purpose of the 'Zone' in a Palo Alto Networks firewall?

Accepted Answer

To group interfaces for security enforcement. Zones are logical groupings of interfaces that allow for granular security policy enforcement.

Answer

To identify applications

Answer

To route traffic

Answer

To group IP addresses

Question 13

Which TWO of the following are valid source types for a Security Policy?

Accepted Answer

Source Address. Security policies can match on Source Zones and Source Address objects.

Answer

QoS profile

Answer

Interface speed

Answer

NAT policy

Question 14

Which THREE items are required for a valid QoS policy match?

Accepted Answer

App-ID or IP address. QoS policies match on the ingress interface, source/destination zone, and the traffic classifier (App-ID/IP).

Answer

NAT policy status

Answer

Security profile

Question 15

What happens if a packet matches multiple security policies?

Accepted Answer

It matches the first one in the list. The firewall evaluates policies from top to bottom and matches the first rule that criteria apply to.

Answer

It is dropped automatically

Answer

It matches the last one

Answer

It matches all of them