NetSec-Analyst Troubleshooting Practice Test 2 — 15 Questions

Question 1

A network security analyst is troubleshooting a Palo Alto Networks firewall where users on the internal network can reach external web servers, but a new web server in the DMZ cannot be reached from the internet. The analyst confirms that the security policy allows the traffic and that the server is up. The analyst suspects a network address translation (NAT) issue. Which CLI command should the analyst use to view the current NAT policy rules and their hit counts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show running nat-policy. The correct command is 'show running nat-policy' because it displays the active NAT policy rules and their hit counts, which helps the analyst verify if the expected NAT rule is being matched. This is crucial for troubleshooting connectivity issues where NAT might be misconfigured or not applied. The other options are invalid commands that would not provide the necessary information.

Answer

show nat-policy

Answer

show nat rules

Answer

show config running nat

Question 2

A network security analyst is investigating why a client cannot reach a web server. The analyst runs 'test security-policy-match from trust to untrust source 10.1.1.50 destination 203.0.113.10 destination-port 443 protocol 6' and the output shows that the traffic matches a security policy with action 'allow', but the client still cannot connect. The analyst suspects that the application is not being identified correctly. Which TWO additional checks should the analyst perform to validate application identification? (Choose two.)

Accepted Answer

Check the application override policy to see if it is forcing a different application.. To validate application identification, the analyst should check the actual identified application in the session table and ensure no application override policy is interfering. The session table shows real-time App-ID results, while application override policies can force incorrect identification, both of which are critical for troubleshooting App-ID issues.

Answer

Verify that the security policy allows the required application by checking the policy's application settings.

Answer

Run 'show counter global filter delta yes' to check for application identification errors.

Answer

Use 'test application' command to simulate the application identification for the traffic.

Question 3

A network security analyst is troubleshooting an issue where a specific application is not being identified correctly by the firewall's App-ID engine. The analyst wants to gather information to determine why the application is being misclassified. Which two actions should the analyst take to troubleshoot this issue? (Choose two.)

Accepted Answer

Check the application's signature version and ensure it is up to date.. App-ID misidentification often stems from outdated signatures or non-standard ports. Ensuring the signature database is current and verifying the port used by the application are direct troubleshooting steps. Checking logs and restarting services are less effective for diagnosing the root cause. The correct actions focus on the two most common causes of App-ID failure.

Answer

Check the session details in the traffic log to see what application was identified and the applied policy.

Answer

Restart the management plane to clear any temporary App-ID cache issues.

Answer

Disable SSL decryption to see if the application is identified correctly without it.

Question 4

A security analyst is investigating a report of slow network performance for a specific application. The analyst suspects that the firewall is performing excessive threat inspection, causing latency. The analyst wants to verify which security profiles are applied to the relevant security policy rule and whether any are causing high CPU usage. Which CLI command should the analyst use to view the security profiles attached to a specific rule?

Accepted Answer

show security-policy rule . To identify security profiles attached to a specific security policy rule, the analyst should use a command that displays the rule's configuration in detail. The 'show security-policy rule ' command provides this information, listing all associated profiles. This enables the analyst to correlate profile usage with performance issues and adjust configurations if necessary.

Answer

show profile-setting

Answer

show security profiles

Answer

show running security-policy

Question 5

A network security analyst is troubleshooting a Palo Alto Networks firewall where users on the internal network can reach external web servers, but a new web server in the DMZ cannot be reached from the internet. The analyst confirms that the security policy allows the traffic and that the server is up. The analyst suspects a network address translation (NAT) issue. Which CLI command should the analyst use to view the current NAT policy rules and their hit counts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

test security-policy-match source 10.1.1.1 destination 192.168.1.1 destination-port 443 protocol 6. The correct syntax for the 'test security-policy-match' command includes parameters 'source', 'destination', 'destination-port', and 'protocol' (numeric). The command simulates a packet and shows which security policy rule would match. It is a powerful troubleshooting tool to verify policy order and match conditions without sending actual traffic. The other options have incorrect parameter names or formats.

Answer

test security-policy-match source 10.1.1.1 destination 192.168.1.1 port 443 protocol tcp

Answer

test security-policy-match from 10.1.1.1 to 192.168.1.1 port 443 protocol tcp

Answer

test security-policy-match source-ip 10.1.1.1 destination-ip 192.168.1.1 destination-port 443 protocol 6

Question 6

A network security analyst is troubleshooting a Palo Alto Networks firewall where users on the internal network can reach external web servers, but a new web server in the DMZ cannot be reached from the internet. The analyst confirms that the security policy allows the traffic and that the server is up. The analyst suspects a network address translation (NAT) issue. Which CLI command should the analyst use to view the current NAT policy rules and their hit counts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run 'test application' with source <client-IP>, destination 10.10.20.5, protocol 6, and destination port 8080 to see which application the firewall identifies.. The firewall is not forwarding the SYN, which often indicates the security policy did not match because the application or service was not as expected. The 'test application' command simulates App-ID for a specific flow and shows the identified application. If the identified application differs from the one in the policy, the policy will not match and the packet will be dropped, explaining the missing SYN-ACK.

Answer

Run 'test security-policy-match' with source 10.10.20.5, destination <client-IP>, protocol 6, and destination port 8080.

Answer

Use 'show session all filter destination 10.10.20.5' to confirm whether a session was created for the flow.

Answer

Run 'show counter global filter delta yes' to look for drops related to the flow's ingress interface.

Question 7

A security analyst is investigating a sudden increase in CPU usage on a Palo Alto Networks firewall. The analyst wants to identify which process is consuming the most CPU resources on the management plane. Which CLI command should the analyst use?

Accepted Answer

top. The top command is the standard utility for viewing real-time process activity on the management plane. It sorts processes by CPU usage, making it easy to spot the one causing high load. Other commands provide summary or dataplane-focused information but do not list individual management plane processes. Therefore, top is the correct choice for this troubleshooting task.

Answer

show running resource-monitor

Answer

show system resources

Answer

debug management-plane cpu

Question 8

A network security analyst notices that a critical application is being blocked by the firewall even though a security policy rule allows it. The analyst runs 'test security-policy-match' and sees that the traffic matches a deny rule with a higher priority. The analyst suspects that the application is not being correctly identified. Which log column should the analyst examine to confirm the application identification and determine why it is misclassified?

Accepted Answer

Application. The 'Application' column in the traffic log provides the identified application and often includes additional context about how it was identified, such as 'ssl (Certificate)' or 'web-browsing (HTTP)'. This helps the analyst understand if the firewall is using a port-based or signature-based identification, which can explain why a deny rule is matching. The 'App-ID' column only shows the final application name without the method, making it less useful for diagnosing misclassification.

Answer

Session End Reason

Answer

Application Detail

Answer

App-ID

Question 9

A network security administrator is troubleshooting an issue where users cannot access a web application hosted on an internal server. The security policy is configured to allow the application, but traffic is being denied. The administrator suspects that the application is being identified incorrectly. Which two actions should the administrator take to verify and resolve the App-ID identification issue? (Choose two.)

Accepted Answer

Use 'test security-policy-match' with the source, destination, and service to see which security policy rule matches and what application is identified.. To verify App-ID identification, the administrator should use 'test security-policy-match' to simulate the traffic and see the identified application, and examine the traffic log for the actual application recorded. These methods directly show what App-ID the firewall is applying, allowing the administrator to confirm misidentification and take corrective action such as creating an application override.

Answer

Run 'debug app-id' to enable debugging for App-ID and capture real-time identification details for the traffic.

Answer

Run 'show session all filter application <app-name>' to check which application is currently identified for the session.

Answer

Check the App-ID cache with 'show app-id-cache' to see if the application signature is outdated and needs updating.

Question 10

A network security analyst is troubleshooting an issue where a user cannot access a website. The analyst suspects that the firewall is blocking the traffic due to a URL filtering profile. Which CLI command should the analyst use to verify if the URL is being blocked by a URL filtering profile?

Accepted Answer

test url . The 'test url ' command is used to check how a URL is categorized and what action the URL filtering profile would take. It provides details such as the URL category and whether it would be blocked or allowed. This directly addresses the analyst's need to verify if the website is being blocked by URL filtering. Other commands listed are invalid and would not provide the necessary information.

Answer

test url-filtering <url>

Answer

show url-filtering test <url>

Answer

show url-filtering category <url>

Question 11

A network security analyst is troubleshooting an issue where a user cannot access a specific website. The analyst checks the traffic log and sees that the session is being denied by a security policy. The analyst wants to determine which security policy rule is blocking the traffic. Which action should the analyst take?

Accepted Answer

Use the 'test security-policy-match' command with the appropriate source, destination, and application to see which rule matches.. The 'test security-policy-match' command is designed to simulate traffic and show which security policy rule matches, including the action (allow/deny). It considers all match criteria such as source, destination, application, user, and URL category. This allows the analyst to quickly identify the blocking rule without disrupting production traffic. Manual review or disabling policies are inefficient and risky.

Answer

Review the security policy rules in order and manually check which one matches the traffic.

Answer

Check the session details in the traffic log to see the rule name that denied the traffic.

Answer

Disable all security policies one by one to see which one is blocking the traffic.

Question 12

A network security analyst is troubleshooting a site-to-site VPN where the tunnel status is 'up', but users cannot access resources across the tunnel. The analyst suspects that the proxy IDs are misconfigured. Which CLI command should the analyst use to verify the proxy IDs for the tunnel?

Accepted Answer

show vpn ike-sa gateway . To verify proxy IDs, the analyst should use 'show vpn ike-sa gateway ' because it provides detailed IKE SA information, including the proxy IDs negotiated in phase 2. This allows the analyst to confirm whether the local and remote proxy IDs match the peer's configuration, which is a common cause of VPN traffic failures despite the tunnel being up.

Answer

show vpn flow

Answer

show vpn ipsec-sa

Answer

show vpn ike-sa

Question 13

A security analyst is investigating a performance issue where a firewall's dataplane CPU is consistently high. The analyst suspects that a specific application is consuming excessive resources due to a large number of sessions. Which CLI command should the analyst use to identify the top applications by session count?

Accepted Answer

show session all filter application. To identify the top applications by session count, the analyst should use 'show session all filter application' to list all sessions with application details, then sort or count them. This command provides the necessary data to pinpoint which application is generating the most sessions. Other commands either show aggregate statistics or require prior knowledge of the application, making them less effective for this diagnostic task.

Answer

show session all filter application <app-name>

Answer

show session info

Answer

show running resource-monitor

Question 14

A security administrator is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing through it. The administrator has verified that the security policies allow the traffic and that the tunnel interfaces are correctly configured. Which tool should the administrator use to determine if the packets are being encrypted and sent into the tunnel?

Accepted Answer

Use the 'show vpn flow' command to display detailed information about the VPN tunnel, including packet counters and encryption status.. The 'show vpn flow' command is designed to display detailed VPN tunnel statistics, including packet counters for encrypted and decrypted traffic. If the tunnel is up but no traffic is passing, these counters will reveal whether packets are being encrypted and sent into the tunnel. This directly addresses the administrator's need to verify encryption and transmission.

Answer

Run a packet capture on the tunnel interface to see if packets are being encrypted and encapsulated.

Answer

Use the 'show interface tunnel' command to verify the tunnel interface status and see if packets are being transmitted.

Answer

Check the system log for IKE negotiation errors that might indicate a problem with the VPN tunnel establishment.

Question 15

A network security analyst is troubleshooting a Palo Alto Networks firewall where users on the internal network can reach external web servers, but a new web server in the DMZ cannot be reached from the internet. The analyst confirms that the security policy allows the traffic and that the server is up. The analyst suspects a network address translation (NAT) issue. Which CLI command should the analyst use to view the current NAT policy rules and their hit counts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

debug dataplane packet-diag set filter match source 10.1.1.100 destination-port 80. The packet diagnostic filter in the dataplane allows the analyst to capture the actual packets for the session, including those processed by App-ID. This is the most direct way to see the application data and understand why App-ID marked the application as 'incomplete', such as missing handshake or unrecognized payload.

Answer

show counter global filter delta yes

Answer

show session id <session-id>

Answer

tcpdump filter 'host 10.1.1.100 and port 80'