NetSec-Analyst Policy Creation And Application — Timed 10 Questions

Question 1

An administrator needs to ensure that internal users can only access a specific cloud-based SaaS application using their corporate credentials. Which App-ID feature should be utilized in the Security Policy?

10 minute time limit — choose an answer to begin.

Accepted Answer

Application Filters. App-ID control, specifically using the 'App-ID' field combined with 'Application Override' or specific 'Cloud-SaaS' App-ID signatures, ensures granular control over sub-functions of an application.

Answer

App-ID Tagging

Answer

Application Override

Answer

Service Objects

Question 2

You are designing a QoS policy. You want to prioritize VoIP traffic over bulk file transfers. Which component must you create to classify the VoIP traffic?

Accepted Answer

A QoS profile with a specific class and priority.. QoS profiles are applied to QoS policies to define the class and priority of the traffic.

Answer

An App-ID override.

Answer

A Security policy with a QoS tag.

Answer

A Traffic Shaping policy.

Question 3

Which THREE steps are required to correctly implement User-ID mapping using the Windows-based User-ID agent?

Accepted Answer

Install the User-ID agent on a Windows server.. Option B is correct because the Windows-based User-ID agent must be installed on a Windows server (or domain member server) so it can collect user-to-IP mapping data and forward it to the firewall. Option C is correct because User-ID must be enabled on the zone interface (the security zone where the users reside) so the firewall can associate the received mappings with traffic in that zone. Option E is correct because the agent must be configured to monitor Security Event Logs on Domain Controllers to parse Windows logon events (e.g., event IDs 4624) and build the user-to-IP mappings. Option A is incorrect because GlobalProtect is a separate remote-access/VPN solution and is not required for Windows-based User-ID mapping. Option D is incorrect because captive portal is an authentication method for unknown users and is not a required step for implementing User-ID with the Windows agent.

Answer

Install the GlobalProtect agent on all workstations.

Answer

Set the firewall to use a captive portal for all users.

Question 4

When configuring a QoS policy, what is the first step the administrator must take to ensure the traffic is correctly prioritized?

Accepted Answer

Enable QoS on the egress interface. Before QoS can be applied, the traffic must be identified and classified by the QoS policy based on the ingress interface and traffic matching criteria.

Answer

Create a new zone

Answer

Configure NAT policy

Answer

Delete all App-IDs

Question 5

A company is transitioning to a new NAT design. They need to translate traffic from the internal 10.0.0.0/24 network to a specific public IP that is NOT assigned to the firewall interface. Which NAT type is appropriate?

Accepted Answer

Static IP. Destination NAT or static NAT with a specific translation can map internal IPs to a specific external address not bound to the interface.

Answer

Dynamic IP and Port (DIPP)

Answer

Interface-based dynamic IP

Answer

Destination NAT

Question 6

Which TWO settings must be correctly configured to ensure User-ID can properly map an IP address to a user identity in a multi-site environment?

Accepted Answer

IP-User Mapping. Option B (IP-User Mapping) is correct because User-ID fundamentally relies on the IP-to-user mapping table, which is populated by sources such as the User-ID Agent, Terminal Services Agent, or syslog parsing, and this mapping is what allows the firewall to associate a source IP with a specific username in a multi-site environment. Option E (Group Mapping) is correct because mapping users to their directory groups is essential for enforcing policy based on group membership, and without proper group mapping the firewall cannot resolve a user's group affiliations even if the IP-to-user mapping exists. Options A (QoS policy settings) and C (Security policy zones) are not required for the identity mapping process itself; QoS controls bandwidth and zones define traffic segmentation, neither of which populates the User-ID table. Option D (NAT policy configuration) is also not required for User-ID mapping, since NAT affects address translation rather than the user identity resolution mechanism.

Answer

QoS policy settings

Answer

Security policy zones

Answer

NAT policy configuration

Question 7

An administrator configured a security policy with an App-ID of 'web-browsing' and 'ssl', but users cannot access a specific internal portal. The logs show 'ssl' and 'web-browsing' are matched, but the session is dropped. What is the likely cause?

Accepted Answer

The session requires allowing the dependent application explicitly. The firewall requires 'web-browsing' and 'ssl' to be in the policy, but if the application has dependencies, those must also be explicitly allowed.

Answer

The policy lacks the 'web-searching' application dependency

Answer

The application dependency 'web-browsing' is not sufficient for 'ssl'

Answer

The zone protection profile is blocking the traffic

Question 8

To optimize security policy management, an administrator wants to group multiple Security policies together. What feature should be used?

Accepted Answer

Policy Rule Groups. Policy Rulebases can be organized into 'Rule Groups' to help manage and view policies more efficiently.

Answer

Address Groups

Answer

Device Groups

Answer

Service Groups

Question 9

Which security policy action is used to drop traffic without sending a TCP RST or ICMP unreachable message?

Accepted Answer

Deny. The 'Drop' action silently discards the packet, whereas 'Reset' sends a TCP RST or ICMP unreachable.

Answer

Reject

Answer

Allow

Answer

Reset

Question 10

An administrator wants to ensure that all internal traffic to the internet is encrypted. Which policy type would be used to enforce this?

Accepted Answer

Decryption Policy. The Decryption Policy is used to configure SSL Forward Proxy or SSL Inbound Inspection to inspect and enforce encryption requirements.

Answer

NAT Policy

Answer

Security Policy

Answer

QoS Policy