NetSec-Analyst Policy Creation And Application Practice Test 6 — 15 Questions

Question 1

An administrator is creating a security policy to allow outbound web traffic. The policy uses the application 'web-browsing' and the service 'application-default'. A user reports that a website using a non-standard port (TCP 8080) is blocked. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service 'application-default' only allows the default ports for the application.. The service 'application-default' limits the policy to the default ports for the specified application. For 'web-browsing', that is TCP 80. Traffic on TCP 8080 does not match, so it is blocked. To allow it, the administrator must change the service to 'any' or create a custom service for TCP 8080 and include it in the policy.

Answer

The security policy must be placed below a deny rule to take effect.

Answer

The application 'web-browsing' requires SSL decryption to work on non-standard ports.

Answer

The application 'web-browsing' does not support non-standard ports.

Question 2

An analyst is reviewing a firewall policy that permits outbound traffic from the Trust zone to the Untrust zone using the application 'web-browsing'. During an incident, the analyst notices that an internal host is accessing an external site over TCP port 8080, but the firewall logs show the session as 'web-browsing' and allows it. Which mechanism is responsible for this behavior?

Accepted Answer

The firewall uses App-ID to identify the application based on its protocol characteristics, regardless of the port number.. App-ID decouples application enforcement from port numbers, so a policy permitting web-browsing will allow that application on any port, including 8080. The firewall identifies the application by inspecting the session, not by assuming the port. This is why the session is logged as web-browsing and permitted, even though the port is non-standard.

Answer

The firewall uses the SSL decryption policy to identify the application, and decryption automatically permits the traffic.

Answer

The firewall falls back to port-based rule matching when the application is unknown, and port 8080 is implicitly allowed.

Answer

The firewall uses the service object 'service-http' which includes port 8080 by default.

Question 3

A security analyst is reviewing a security policy that has the action 'allow' and the profile 'strict' applied. The profile includes antivirus, anti-spyware, and vulnerability protection. A user reports that a file download from a trusted site is being blocked. The analyst checks the Threat log and sees a 'virus' signature with action 'block'. What is the most likely cause of the block?

Accepted Answer

The security policy action is set to 'allow', so the block must come from the Security Profile.. The block is caused by the Security Profile, specifically the antivirus component, which detected a virus signature and took the configured action to block. The security policy action 'allow' only permits the traffic; it does not perform content inspection.

Answer

The firewall's content update is out of date, causing a false positive.

Answer

The security policy action is set to 'deny', overriding the profile.

Answer

The file is blocked because the URL Filtering profile is missing.

Question 4

A security analyst is asked to create a policy that logs all traffic from the guest wireless network to the internet, including allowed and denied sessions, for compliance reporting. Which action should be taken when configuring the security policy rule?

Accepted Answer

Enable logging at session end for the allow rule and enable logging for the deny rule.. To log all traffic, the allow rule must log at session end, and the deny rule must log denied sessions. Session-end logging captures full session details, while deny logging records blocked attempts. Together they provide the complete audit trail required for compliance reporting on guest network traffic.

Answer

Enable logging at session start for the allow rule and enable logging for the deny rule.

Answer

Enable logging only on the deny rule and rely on the default allow rule for permitted traffic.

Answer

Enable logging at session start for both the allow and deny rules.

Question 5

An administrator needs to allow access to a new internal web application for employees in the 'Marketing' user group. The application uses a custom TCP port 8443. Which policy configuration should the administrator use to minimize security risk while ensuring access?

Accepted Answer

Create a security policy with application 'web-browsing' and a custom service for TCP 8443, and source user group 'Marketing'.. The most secure and effective policy uses the specific application 'web-browsing' and a custom service for TCP 8443, restricted to the Marketing user group. This adheres to least privilege by allowing only the necessary application and port for the intended users, minimizing the attack surface.

Answer

Create a security policy with application 'any' and service 'application-default', and source user group 'Marketing'.

Answer

Create a security policy with application 'web-browsing' and service 'any', and source user group 'Marketing'.

Answer

Create a security policy with application 'ssl' and service 'application-default', and source user group 'Marketing'.

Question 6

A security administrator is creating a new security policy rule to allow internal users to access an external SaaS application. The administrator wants to ensure that only the specific application is permitted, not all web traffic. Which policy component should be used to achieve this?

Accepted Answer

Application object. To allow a specific SaaS application while denying other web traffic, the policy must reference the application object for that SaaS service. Application objects are the granular unit for App-ID enforcement. Service objects, URL categories, and application filters are either too broad or based on different criteria, so they cannot precisely restrict traffic to the single desired application.

Answer

URL category

Answer

Application filter

Answer

Service object

Question 7

A security analyst at a financial firm is reviewing the firewall rulebase after an audit finding. The auditor noted that several rules have the action set to 'allow' but no security profiles attached. The analyst wants to enforce a policy that prevents any allowed traffic from bypassing threat inspection, while still allowing the business applications. What should the analyst do first to align with a defense-in-depth policy?

Accepted Answer

Create a Security Profile Group that includes Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and File Blocking, then attach it to all allow rules.. The correct approach is to attach a Security Profile Group to all allow rules. This enforces content inspection on permitted traffic without disrupting business applications. It aligns with defense-in-depth by ensuring that even allowed traffic is scanned for threats. The other options either disrupt traffic, do not enforce inspection, or attempt to modify an immutable default rule.

Answer

Enable 'Log at Session Start' on all allow rules and review the logs to identify which applications need profiling.

Answer

Change the action of all allow rules to 'deny' and create new allow rules with profiles attached.

Answer

Modify the default interzone-default rule to include security profiles and set it to allow.

Question 8

A security analyst is reviewing a policy that allows access to a critical internal application. The application is accessed by users from multiple departments, and the analyst wants to ensure that only users who are currently authenticated and mapped to the correct department can access it. The firewall is integrated with Active Directory via User-ID. Which policy configuration best enforces this requirement?

Accepted Answer

Create a security policy that uses the department user group as the source and the application as the destination, with the application's App-ID.. Enforcing department-specific access requires using the department user group as the source in the security policy. This leverages User-ID to map authenticated users to groups, so only users in the correct department are allowed. The destination and App-ID further scope the rule to the specific application, achieving both identity and application control.

Answer

Create a security policy that uses the department user group as the source and allows all applications to the application server.

Answer

Create a security policy that uses the department's IP subnet as the source and the application as the destination.

Answer

Create a security policy that uses the application's App-ID and the department's IP subnet, and enable User-ID on the zone.

Question 9

A security analyst is tasked with creating a policy to block traffic from known malicious IP addresses. The analyst wants to use a dynamic list that is automatically updated. Which two components are required to implement this? (Choose two.)

Accepted Answer

Security policy with EDL as source. To block traffic from a dynamic list, an External Dynamic List (EDL) must be configured to retrieve the list of malicious IPs. Then, a security policy must be created that references the EDL as the source and sets the action to deny. Together, these components provide automatic updates and enforcement.

Answer

Application override policy

Answer

Log Forwarding profile

Answer

Dynamic Address Group

Question 10

A network security analyst is designing a policy for a new branch office that will use a Palo Alto Networks firewall. The branch has a mix of corporate-owned devices and guest devices. The analyst must ensure that guest traffic is isolated from the corporate network and that corporate traffic is inspected for threats. The branch uses a single firewall with multiple zones. Which two actions should the analyst take to meet these requirements? (Choose two.)

Accepted Answer

Apply a Security Profile Group to the corporate-to-internet allow rule to inspect for threats.. Separate zones for corporate and guest traffic enable distinct policy enforcement, and applying a Security Profile Group to the corporate-to-internet rule ensures threat inspection. Together, these actions meet the isolation and inspection requirements. The other options either allow unwanted traffic or fail to provide proper segmentation.

Answer

Create a single zone for all traffic and use application filters to differentiate corporate and guest traffic.

Answer

Set the action of the guest-to-corporate rule to 'allow' but enable logging to monitor access.

Answer

Configure a security policy that allows guest zone to corporate zone traffic only for DNS and DHCP.

Question 11

A network security analyst is reviewing a rulebase where a security policy allows traffic from the 'Guest' zone to the 'Internet' zone with an application filter that permits only 'web-browsing' and 'ssl'. Users report they cannot reach a new SaaS application that uses QUIC over UDP 443. The analyst confirms the application is identified as 'quic-base' by App-ID. Which action should the analyst take to allow the SaaS application while maintaining the least privilege?

Accepted Answer

Add 'quic-base' to the existing application filter attached to the security policy.. Application filters are the correct mechanism to permit a specific set of applications without opening the policy to all traffic. Adding the 'quic-base' signature to the existing filter allows the firewall to identify and allow that application while keeping the policy restrictive. Changing to 'any', adding a service object, or disabling App-ID would all either over-permit or fail to identify the application correctly.

Answer

Change the security policy to allow the 'any' application and rely on the 'ssl' service for decryption.

Answer

Create a new service object for UDP 443 and add it to the existing policy's service field.

Answer

Disable App-ID on the policy so the firewall falls back to port-based rules and permits UDP 443.

Question 12

A NetSec-Analyst is writing a security policy baseline for a Palo Alto Networks firewall. The security team wants to ensure that any traffic not explicitly permitted by a security policy is logged and blocked, but they also need to allow a temporary exception for a vulnerability scanner during an authorized penetration test. The scanner must be permitted from a specific management subnet to all internal zones. Which policy configuration best meets these requirements while maintaining least privilege?

Accepted Answer

Create an interzone policy from the management zone to the specific internal zones, source scanner IP, application set to the specific scanner application signatures, and action allow, placed above the implicit deny rule.. The best policy restricts the source to the scanner IP, limits destinations to the specific internal zones, and uses specific application signatures, while being placed above the implicit deny rule. This enforces least privilege and maintains logging. Broad any-application rules, modifying the implicit deny, or universal allow rules all violate the principle of least privilege and fail to provide the required control.

Answer

Create an interzone policy from the management zone to all internal zones with the scanner's IP as source, application any, and action allow, placed above the implicit deny rule.

Answer

Modify the implicit deny rule to allow traffic from the management subnet to all zones, then rely on the scanner's own IP allowlist to restrict access.

Answer

Create a universal policy with source any, destination any, application any, and action allow, but enable security profiles to log all traffic.

Question 13

A security analyst is drafting a policy that defines how the organization classifies data and who may access each class. Which document type is the analyst creating?

Accepted Answer

A data classification and handling policy. The activity described is defining data sensitivity classes and the access rules for each, which is the purpose of a data classification and handling policy. Incident response, business continuity, and acceptable use documents serve different governance functions and do not establish classification schemes or class-based access entitlements.

Answer

A business continuity plan

Answer

An incident response plan

Answer

An acceptable use policy

Question 14

A network security analyst is reviewing a Security Policy on a Palo Alto Networks firewall. The policy includes a rule that allows traffic from the 'Trust' zone to the 'Untrust' zone with the Application 'ssl' and Service 'application-default'. Users report that they cannot access an internal web server that uses a self-signed certificate on port 8443. The firewall logs show that the traffic is being denied. What is the most likely reason for the denial?

Accepted Answer

The application 'ssl' does not include port 8443 in its application-default service.. The denial occurs because the 'ssl' application's default service only includes TCP 443. Port 8443 is non-standard for SSL, so the application-default service does not cover it. The firewall therefore does not match the traffic to the allow rule and applies the default deny. To resolve this, the administrator must adjust the service to include port 8443, either by using a custom service or by setting the service to 'any' (though that is less secure).

Answer

The 'Trust' zone is not configured to allow traffic to the 'Untrust' zone on port 8443.

Answer

The self-signed certificate is not trusted by the firewall, causing the session to be denied.

Answer

The 'ssl' application requires SSL decryption to be enabled for the policy to match.

Question 15

A security analyst discovers that a firewall rule allowing outbound DNS was added by a contractor without following the change process. The rule is currently required for a critical service. What is the MOST appropriate immediate action?

Accepted Answer

Document the rule retroactively, obtain approval, and initiate a review of how the unauthorized change occurred.. When a necessary change was made outside the process, the best immediate action is to legitimize it through documentation and approval while investigating the process failure. Deleting the rule causes an outage, ignoring it perpetuates the gap, and broad reversion risks unrelated disruption. The chosen action maintains service and restores governance.

Answer

Immediately delete the rule to enforce the change process.

Answer

Disable the contractor's account and revert all recent changes.

Answer

Take no action because the rule is required and functioning correctly.