NetSec-Analyst Troubleshooting Practice Test 4 — 15 Questions

Question 1

An administrator suspects that a specific App-ID is not correctly identifying traffic. Which log column should they examine to confirm the application match?

Accepted Answer

Application. The 'Application' column in the Traffic log explicitly displays what the firewall identified as the application for the session.

Answer

Category

Answer

Policy

Answer

Service

Question 2

When an administrator sees 'incomplete' in the Application column of the traffic logs, what does this usually signify?

Accepted Answer

The session closed before App-ID could be determined. Incomplete means the firewall did not see enough packets to successfully identify the application (e.g., the session closed too early).

Answer

The application is unknown

Answer

The rule was denied

Answer

The traffic is encrypted

Question 3

Which TWO of the following settings must be verified to ensure successful SSL Decryption?

Accepted Answer

SSL Decryption Policy. To ensure successful SSL Decryption, you must verify the SSL Decryption Policy (Option A), because this policy defines which traffic is decrypted, which traffic is bypassed, and which decryption profile is applied; without a matching rule, traffic will not be decrypted. You must also verify CA Certificate trust (Option B), because the firewall's forward-trust or forward-untrust certificate must be trusted by the endpoint, otherwise the client will reject the re-signed certificate and the decrypted session will fail. GlobalProtect configuration (Option C) is not required for SSL Decryption itself, as it is a remote-access VPN feature and only relevant if traffic is tunneled through GlobalProtect. Client-side browser cache (Option D) does not affect decryption success and is not a required setting to verify. App-ID database version (Option E) affects application identification and content inspection but is not a prerequisite setting for enabling SSL Decryption.

Answer

GlobalProtect configuration

Answer

Client-side browser cache

Answer

App-ID database version

Question 4

Which TWO of the following represent valid interface types on a Palo Alto Networks firewall?

Accepted Answer

Layer 3. On a Palo Alto Networks firewall, the valid interface types are Layer 3, Layer 2, virtual wire, tap, and tunnel interfaces, so option B (Layer 3) is correct because a Layer 3 interface is a routed interface that has an IP address and participates in routing decisions. Option E (Layer 2) is also correct because a Layer 2 interface operates in transparent mode, forwarding traffic based on MAC addresses and VLANs without an IP address. Options A (Layer 4), C (Layer 5), and D (Layer 1) are not valid interface types on the platform; although the firewall inspects traffic up through the application layer, its configurable interface types are not named after OSI layers 1, 4, or 5.

Answer

Layer 4

Answer

Layer 5

Answer

Layer 1

Question 5

Which TWO log types are stored on the Palo Alto Networks firewall locally?

Accepted Answer

Threat Log. Threat Log (A) is correct because the Palo Alto Networks firewall stores threat logs locally in its log database, recording entries generated by the Threat Prevention, Antivirus, Anti-Spyware, and Vulnerability Protection security profiles when traffic matches a threat signature. Traffic Log (B) is also correct because the firewall writes traffic logs locally to its on-box log storage, capturing session details such as source/destination, application, and action for every session that matches a security rule with logging enabled. Cloud Logging (C) is not a local log type—it refers to forwarding logs to cloud-based services such as Cortex Data Lake or Strata Logging Service, which reside off-box. Panorama Log (D) is incorrect because Panorama is a separate centralized management appliance that aggregates logs from managed firewalls, not a log type stored locally on the firewall itself. External Syslog (E) is incorrect because syslog refers to forwarding logs to an external syslog server over UDP/TCP port 514 or TLS 6514, which is off-box storage rather than local firewall storage.

Answer

Cloud Logging

Answer

Panorama Log

Answer

External Syslog

Question 6

Which THREE items can be used as filters in the 'test security-policy-match' command?

Accepted Answer

Destination IP. The 'test security-policy-match' command on Palo Alto Networks firewalls accepts traffic-identification parameters so you can simulate a flow and see which security policy rule it matches. Option A (Destination IP) is correct because the command supports a destination-ip filter to specify the flow's destination address. Option B (Source IP) is correct because the command supports a source-ip filter to specify the flow's source address. Option D (Application) is correct because the command supports an application filter (e.g., 'application web-browsing') to identify the App-ID of the simulated traffic. Option C (Device serial number) is not a traffic-matching parameter for this command, and Option E (Log level) is a logging attribute, not a filter used to match a security policy.

Answer

Device serial number

Answer

Log level

Question 7

A network security analyst notices that the dataplane CPU on a Palo Alto Networks firewall is consistently above 90%. They need to identify which network interface is generating the highest volume of traffic to pinpoint the source of the load. Which CLI command should they use?

Accepted Answer

show counter interface all. The dataplane CPU load is often driven by high traffic volumes on specific interfaces. To identify which interface is contributing most, the analyst must view per-interface traffic counters. The 'show counter interface all' command provides packet and byte counts for each interface, enabling quick identification of the busiest one. Commands that show status, resource usage, or session details do not offer this per-interface traffic breakdown.

Answer

show session all filter destination 10.0.0.1

Answer

show interface all

Answer

show running resource-monitor

Question 8

A network security analyst is troubleshooting a connectivity problem where internal users cannot reach an external web server. The analyst suspects a NAT issue. After running a packet capture on the firewall, the analyst sees that the source IP address of outbound packets is not being translated to the firewall's external IP address. Which of the following is the most likely cause?

Accepted Answer

The NAT policy is misconfigured or the rule order is incorrect, causing the traffic to match a different NAT rule or no rule at all.. The packet capture shows outbound packets with untranslated source IP addresses, meaning the firewall is not applying source NAT as expected. This points to a NAT policy misconfiguration or incorrect rule order, where traffic is not matching the intended NAT rule. The security policy might allow the traffic, but NAT is a separate configuration. Routing and server-side blocking would produce different symptoms.

Answer

The security policy permitting the traffic does not have NAT enabled.

Answer

The web server is blocking traffic from the internal IP addresses due to a security policy.

Answer

The firewall's routing table does not have a route to the external web server.

Question 9

A network security analyst is troubleshooting an intermittent connectivity issue between a client and a server. The analyst suspects that certain packets are being dropped by the firewall's security policy. The analyst runs 'test security-policy-match' with the relevant parameters on a Palo Alto Networks firewall. Which output field in the CLI result should the analyst examine to identify the specific security policy rule that matched the traffic?

Accepted Answer

Rule name. The test security-policy-match command simulates a traffic flow and reports which security policy rule would match. The output includes a field that names the matching rule, allowing the analyst to pinpoint the exact policy. This is critical for troubleshooting because it directly identifies the rule responsible for the action, enabling focused review of that rule's configuration.

Answer

Application

Answer

Session ID

Answer

Destination port

Question 10

A network administrator is troubleshooting why a site-to-site VPN tunnel between two Palo Alto Networks firewalls is not establishing. The administrator runs 'show vpn ike-sa' and sees that the IKE phase 1 negotiation is failing. Which of the following is the most likely cause?

Accepted Answer

Mismatched pre-shared keys. IKE phase 1 establishes a secure channel for VPN negotiation. A common cause of failure is mismatched pre-shared keys, as both peers must use identical keys. Other parameters like encryption and authentication must also match, but pre-shared key mismatch is a frequent and easily overlooked issue. Correcting the key on both sides resolves the phase 1 failure.

Answer

Incorrect proxy IDs

Answer

Mismatched encryption algorithms

Answer

Firewall blocking UDP port 500

Question 11

An administrator is troubleshooting why a site-to-site VPN tunnel is not passing traffic despite the tunnel showing as 'up'. The administrator suspects that the Phase 2 selectors (proxy IDs) are mismatched. Which TWO commands should the administrator use to verify the proxy IDs on both ends of the tunnel? (Choose two.)

Accepted Answer

show vpn ipsec-sa gateway <gateway-name>. The commands 'show vpn ipsec-sa' and its gateway-specific variant display the Phase 2 security associations, which include the proxy IDs (local and remote subnets). By comparing these on both ends, the administrator can identify mismatches. If the proxy IDs do not match, the tunnel may be up but traffic will not pass because the selectors do not align. These commands are essential for troubleshooting such issues.

Answer

show vpn flow

Answer

show vpn ike-sa gateway <gateway-name>

Answer

show vpn ike-sa

Question 12

A network security analyst is troubleshooting an issue where users on the internal network cannot access a web server hosted in the DMZ. The analyst runs 'show session all filter source 10.1.1.100 destination 192.168.1.50' on the firewall and sees a session in the 'discard' state. Which action should the analyst take next to determine why the session is being discarded?

Accepted Answer

Run 'show session id ' to view detailed session information including the discard reason.. The session is in a discard state, indicating that the firewall is dropping packets after a policy or security profile action. To find the exact cause, the analyst must inspect the session details using 'show session id ', which reveals the discard reason. Other commands provide broader information but lack session-specific discard context, making them less effective for this precise troubleshooting step.

Answer

Run 'show counter global filter delta yes' to check for packet drops.

Answer

Run 'show log traffic direction equal forward' to check traffic logs.

Answer

Run 'show running security-policy' to review the security rules.

Question 13

A network security analyst notices that a critical business application is intermittently failing. The application traffic passes through a Palo Alto Networks firewall. The analyst wants to identify exactly which security policy rule is allowing or denying the traffic in real time, without committing changes. Which CLI command should the analyst use?

Accepted Answer

test security-policy-match application source destination destination-port protocol . The test security-policy-match command is designed to simulate a traffic flow against the security policy and return the matching rule. By specifying application, source, destination, port, and protocol, the analyst can see exactly which rule would apply, including the action. This is the most direct and accurate method for troubleshooting policy-related connectivity issues without committing changes.

Answer

debug dataplane packet-diag set filter match application <app-name>

Answer

show session all filter application <app-name>

Answer

show running security-policy

Question 14

A security analyst is troubleshooting an issue where a critical application is being blocked intermittently. The analyst suspects that the application is being identified differently at different times. Which TWO actions should the analyst take to verify the application identification and policy matching? (Choose two.)

Accepted Answer

Use 'show session id <session-id>' to view the application identified for a specific session.. Intermittent blocking often stems from inconsistent application identification. Using 'test security-policy-match' allows the analyst to simulate policy evaluation with a specific application, confirming which rule applies. Meanwhile, 'show session id' reveals the actual application identified for a session, enabling comparison across sessions. Together, these tools help diagnose if the firewall is classifying the application differently, leading to policy mismatches.

Answer

Use the 'show session all filter application <app-name>' command to see current sessions for that application.

Answer

Run 'test application <app-name>' to check the application signature and dependencies.

Answer

Run 'show counter global filter delta yes' to check for application identification counters.

Question 15

A network administrator is troubleshooting a connectivity issue between two sites connected by an IPsec VPN. The VPN tunnel status shows as 'up', but no traffic is passing. The administrator wants to verify whether packets are being encrypted and decrypted correctly. Which tool should the administrator use?

Accepted Answer

Use packet capture with filters to capture traffic on the tunnel interface and analyze the packets.. Packet capture is the most effective tool to verify that packets are being encrypted and decrypted correctly. By capturing on the tunnel interface, the administrator can see the encrypted ESP packets, and by capturing on the internal interface, they can see the decrypted payload. This allows direct comparison and confirmation of the encryption/decryption process. Other commands only show status or statistics, not actual packet flow.

Answer

Use the 'test vpn ipsec-sa' command to test the IPsec security association.

Answer

Use the 'show vpn flow' command to view VPN flow statistics.

Answer

Use the 'show vpn ipsec-sa' command to display the IPsec security associations.