NetSec-Analyst Policy Creation And Application Practice Test 7 — 15 Questions

Question 1

A company has a policy that allows users in the Trust zone to access the internet. The security team wants to enforce that only corporate-approved applications are allowed, and all other applications are blocked. They also want to log all allowed traffic for auditing. Which policy configuration achieves this with the least administrative effort?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rule that allows only the approved applications from Trust to Untrust, and set the action to allow with logging enabled. Rely on the implicit deny for all other traffic.. The most efficient way to allow only approved applications while blocking everything else is to create a single allow rule that lists the approved applications, enable logging, and rely on the implicit deny. This requires no additional deny rules and automatically blocks any application not explicitly permitted, satisfying both security and auditing requirements.

Answer

Create a rule that allows all applications from Trust to Untrust, and use an application filter to exclude unapproved applications.

Answer

Create a rule that allows all applications from Trust to Untrust, and then create individual deny rules for each unapproved application.

Answer

Create a rule that denies all applications from Trust to Untrust, and then create allow rules for each approved application.

Question 2

A security administrator is creating a Security Policy rule to allow access to a specific external SaaS application. The administrator wants to ensure that the rule only allows traffic to that application and not to other applications that might use the same ports. Which Palo Alto Networks feature should be used in the Security Policy rule to achieve this granular control?

Accepted Answer

Application (App-ID) in the Security Policy rule. To allow only a specific SaaS application, the administrator should specify that application directly in the Security Policy rule's Application field. App-ID identifies the application based on deep packet inspection, not just ports, so it ensures that only the desired application is permitted. Other features like Application Filters or Service objects do not provide the same level of granularity and could inadvertently allow other applications.

Answer

Application Filter

Answer

Application Override

Answer

Service object with specific ports

Question 3

A security analyst is reviewing a firewall policy that includes a rule allowing traffic from the 'Trust' zone to the 'Untrust' zone with the Application ID 'any'. The analyst notices that the rule has no Security Profiles attached. The analyst wants to enforce a policy that all allowed traffic must be inspected for threats, but also wants to minimize the impact on legitimate traffic. What should the analyst do?

Accepted Answer

Attach a Security Profile Group to the existing rule with 'any' Application ID.. Attaching a Security Profile Group to the existing rule enforces threat inspection on all allowed traffic without changing the allowed applications. This minimizes impact because legitimate traffic continues to be allowed, but is now inspected. The other options either disrupt traffic or do not enforce inspection.

Answer

Create a new rule above the existing rule that denies all traffic without profiles.

Answer

Enable 'Log at Session End' on the rule and review logs to identify applications, then create specific rules.

Answer

Change the Application ID from 'any' to specific applications and attach a Security Profile Group.

Question 4

A network security analyst is configuring a Security Policy on a Palo Alto Networks firewall to allow outbound access for a specific set of applications. The analyst wants to ensure that the policy is as secure as possible while still allowing the required applications. Which two actions should the analyst take when configuring the Security Policy rule? (Choose two.)

Accepted Answer

Use 'application-default' for the Service to enforce standard ports.. The two actions that enhance security are specifying the exact applications needed and using 'application-default' for the Service. Specifying applications ensures only desired traffic is allowed, while 'application-default' enforces standard ports, preventing misuse of non-standard ports. Together, they implement least privilege at both the application and port levels. Other options like setting Service to 'any' or adding logging do not improve the security posture of the rule itself.

Answer

Enable logging at the session end to capture traffic details.

Answer

Set the Service to 'any' to ensure all ports used by the applications are allowed.

Answer

Add a URL Filtering profile to the rule to block malicious sites.

Question 5

A NetSec-Analyst is designing a policy for a Palo Alto Networks firewall that must enforce different security profiles for different user groups. The firewall is integrated with Active Directory via User-ID, and the analyst wants to apply a stricter URL filtering profile to the 'contractors' group while allowing the 'employees' group to access a broader set of categories. The analyst creates two security rules with the same source and destination zones and applications, but different user groups and URL filtering profiles. What must be considered to ensure the correct rule is applied?

Accepted Answer

The rule with the 'contractors' group must be placed above the rule with the 'employees' group, because the first matching rule is applied.. Security rules are evaluated top-down, and the first matching rule wins. To apply stricter URL filtering to contractors, the rule matching the 'contractors' group must be placed above the rule matching the 'employees' group. This ensures contractors hit the stricter rule first, while employees match the broader rule. Group mapping is supported, and profiles are not merged.

Answer

Both rules will be evaluated and the firewall will merge the security profiles, applying the most restrictive URL filtering categories from each.

Answer

User-ID group mapping is not supported in security rules; only individual users can be referenced, so the rules will not work as intended.

Answer

The rule with the 'employees' group must be placed above the rule with the 'contractors' group, because more general rules should be evaluated first.

Question 6

A NetSec-Analyst is tasked with creating a policy that allows internal users to access a specific SaaS application while blocking all other SaaS applications. The firewall is a Palo Alto Networks appliance with App-ID and URL Filtering licensed. The analyst wants to ensure that even if the SaaS application uses dynamic IP addresses and multiple domains, the policy remains effective. Which approach best meets this requirement?

Accepted Answer

Create a security rule that allows the specific SaaS application by its App-ID and attach a URL Filtering profile that blocks all other SaaS categories.. The most effective approach is to allow the specific SaaS application by its App-ID and attach a URL Filtering profile that blocks other SaaS categories. App-ID identifies the application regardless of IP or domain changes, and URL Filtering adds a layer to block other SaaS apps. IP-based rules are brittle, URL-only rules are less precise, and allowing all SSL is too permissive.

Answer

Create a security rule that allows the SaaS application by its URL category and blocks all other URL categories.

Answer

Create a security rule that allows traffic to the SaaS provider's published IP address ranges and blocks all other traffic.

Answer

Create a security rule that allows all SSL traffic and then use a decryption policy to inspect and block other SaaS applications.

Question 7

A NetSec-Analyst is reviewing a Palo Alto Networks firewall policy and needs to ensure that logging and log forwarding are correctly configured for security rules. The analyst wants to capture traffic that is allowed by a specific rule and also capture traffic that is denied by the implicit deny rule. Which two actions must be taken to meet these requirements? (Choose two.)

Accepted Answer

Enable logging at session end on the specific allow rule.. To capture allowed traffic, enable logging at session end on the specific allow rule. To capture denied traffic, create an explicit deny rule with logging enabled and place it above the implicit deny rule, since the implicit deny cannot be modified. Log forwarding is optional, and session start logging is not the standard for capturing allowed sessions.

Answer

Configure a log forwarding profile on the allow rule to send logs to an external syslog server.

Answer

Modify the implicit deny rule to enable logging.

Answer

Enable logging at session start on the allow rule.

Question 8

A security analyst is implementing a policy to block peer-to-peer file sharing applications on a Palo Alto Networks firewall. The analyst creates a security policy that denies traffic from the 'Trust' zone to the 'Untrust' zone with an application filter containing 'bittorrent' and 'gnutella'. However, users are still able to use these applications. Which action should the analyst take to ensure the policy effectively blocks the traffic?

Accepted Answer

Move the deny policy above any allow policies that might match the traffic.. Security policies are processed in order, and the first matching rule is applied. If an allow rule above the deny rule matches the peer-to-peer traffic, the deny rule is never reached. Moving the deny rule above any allow rules ensures that peer-to-peer traffic is blocked. The application filter is correct; the issue is policy ordering.

Answer

Change the deny policy to use a service object for the ports commonly used by peer-to-peer applications.

Answer

Enable decryption on the deny policy to inspect peer-to-peer traffic.

Answer

Add the 'any' application to the deny policy to ensure all applications are blocked.

Question 9

A security analyst is configuring a Palo Alto Networks firewall to allow access to a web application hosted on a server in the DMZ. The application uses a custom TCP port 8443 and is not recognized by App-ID. The analyst wants to allow only this application while still using App-ID for other traffic. Which configuration should the analyst use?

Accepted Answer

Create a custom application signature for the application and add it to the security policy.. To allow a custom application on a non-standard port while still using App-ID, the analyst should create a custom application signature. This enables the firewall to identify the application and enforce policy based on that signature. Using service objects, 'unknown-tcp', or disabling App-ID would not provide the same level of control and would violate least privilege.

Answer

Add the 'unknown-tcp' application to the security policy and allow TCP 8443.

Answer

Disable App-ID on the security policy and rely on port-based rules for all traffic.

Answer

Create a service object for TCP 8443 and add it to the security policy, while setting the application to 'any'.

Question 10

An analyst is reviewing a firewall rulebase and notices that a security policy allowing outbound web traffic has no Application Filters or Service objects attached. The rule uses only source zone, destination zone, and user group as match criteria. What is the primary effect of this policy on traffic classification and enforcement?

Accepted Answer

The firewall will allow all applications and services that match the source, destination, and user criteria.. A security policy with no Application Filters or Service objects matches any application and any service, effectively allowing all traffic that meets the zone and user criteria. This is a common misconfiguration because administrators may assume that App-ID is always enforced, but enforcement requires explicit application or service restrictions. The correct answer reflects that the policy becomes a broad allow rule, which can bypass application control and increase risk.

Answer

The firewall will automatically populate the Application field with 'any' and block unknown-tcp traffic.

Answer

The firewall will apply Layer 7 inspection and block any application not explicitly listed.

Answer

The firewall will require an additional Security Profile to be attached before the policy can commit.

Question 11

A security analyst is creating a policy to allow a specific internal application that uses a proprietary protocol over TCP port 8443. The application is not recognized by App-ID and is currently identified as unknown-tcp. The analyst wants to ensure the traffic is allowed while still enabling threat inspection. Which action should the analyst take in the security policy?

Accepted Answer

Allow the application as unknown-tcp and specify the Service as tcp/8443, then attach a Security Profile.. To allow unidentified TCP traffic on a specific port, the analyst should explicitly select unknown-tcp as the application and define the service as tcp/8443. This narrows the policy to the proprietary protocol while still allowing a Security Profile to inspect the traffic for threats. Using any application or custom objects would either be too broad or not match the traffic correctly.

Answer

Set the Application to any and the Service to application-default, then rely on App-ID to identify the traffic.

Answer

Create an Application Filter that includes unknown-tcp and attach a Security Profile to the policy.

Answer

Create a custom Application object for the proprietary protocol and reference it in the policy.

Question 12

An administrator is implementing a new security policy to allow only specific business applications for the finance department while blocking all other traffic. The firewall is configured with App-ID and User-ID. Which two actions are required to ensure the policy correctly identifies and enforces access for finance users? (Choose two.)

Accepted Answer

Configure User-ID to map IP addresses to finance users via Active Directory integration.. To enforce application access for finance users, the administrator must ensure User-ID correctly maps IP addresses to finance users and explicitly list the allowed business applications in the security policy. These two actions ensure that only finance users can access the specified applications, and all other applications are blocked. Other options address threat prevention or QoS, which are not relevant to this access control requirement.

Answer

Enable DNS sinkholing to prevent access to malicious domains.

Answer

Create a QoS policy to prioritize finance traffic over other departments.

Answer

Attach a Security Profile to the policy to block all non-business applications.

Question 13

A network security analyst is tasked with creating a policy to block traffic from the untrust zone to the trust zone for all applications except DNS and web browsing. The analyst wants to ensure that the policy is as specific as possible while maintaining the ability to log all denied traffic. Which policy action should be used for the deny rule?

Accepted Answer

Deny with logging enabled. The correct action is Deny with logging enabled, as it blocks the traffic and creates logs for all denied sessions. This satisfies the requirement to log all denied traffic while enforcing the block. Other actions like Deny, Drop, or Reset client without logging do not provide the necessary visibility. The analyst should configure the deny rule with logging to capture denied attempts for security monitoring.

Answer

Reset client

Answer

Drop

Answer

Deny

Question 14

A NetSec-Analyst is creating a Security Policy rule to permit a specific internal application for the finance department. The application uses a custom TCP port that is not recognized by App-ID, and the analyst wants to match traffic based on the destination port. Which configuration element must be used in the Security Policy rule to match the custom TCP port?

Accepted Answer

Service object. When an application is not recognized by App-ID and uses a custom TCP port, the analyst must use a Service object to match the destination port. Service objects allow granular control over port-based traffic, which is necessary when App-ID cannot identify the application. This ensures the Security Policy rule correctly permits the finance department's application.

Answer

URL category

Answer

HIP profile

Answer

Application filter

Question 15

A NetSec-Analyst is finalizing a Security Policy rule set on a Palo Alto Networks firewall. The change window requires that all rules be documented so that a future analyst can understand the business justification without contacting the original author. The analyst wants the justification stored inside the policy itself so it travels with the configuration backup. Which policy element should the analyst populate to meet this requirement?

Accepted Answer

The Rule Comments field on each Security Policy rule. Rule Comments is the field designed to hold human-readable documentation attached directly to a Security Policy rule. Because it is part of the rule definition, it is captured in configuration backups, exports, and restores, letting a later analyst understand the business justification without outside references. Zone descriptions, external ticket numbers, and object tags all live outside the rule and therefore cannot satisfy the requirement.

Answer

A separate change-management ticket referenced by rule name

Answer

The Description field on the associated security zone objects

Answer

The tag applied to the address objects used as rule sources