NetSec-Analyst Troubleshooting Practice Test 5 — 15 Questions

Question 1

A network security administrator notices that a critical business application is intermittently failing to connect through the firewall. The security policy allows the application based on its App-ID. During a failure, the administrator runs a packet capture on the firewall and sees that the first few packets of the session are allowed, but subsequent packets are dropped. Which troubleshooting step should the administrator take first to identify the cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the session details in the traffic log for the application to check the session end reason and the applied security policy.. The traffic log records session end reasons that explicitly state why a session was terminated, such as 'policy-deny' or 'threat'. Since the initial packets were allowed, the drop likely occurred due to a policy or threat action on subsequent packets. Reviewing the session details in the traffic log is the most direct and efficient way to identify the cause without disrupting traffic.

Answer

Run a packet capture with a filter for the application's source and destination IP addresses to analyze the dropped packets in detail.

Answer

Use the 'show session all filter application <app-name>' command to view all active sessions for the application and their current state.

Answer

Check the App-ID cache to see if the application is being identified correctly and if there are any recent changes to the application signature.

Question 2

A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?

Accepted Answer

Use the 'debug dataplane packet-diag set filter' command to set up a packet capture.. To inspect packet payload for data exfiltration, the analyst must capture raw packets. The 'debug dataplane packet-diag set filter' command enables setting up a packet capture filter on the dataplane. Once captured, the packets can be viewed or exported for analysis, revealing the payload. Other commands provide session metadata or policy information but lack the ability to show actual packet contents.

Answer

Use the 'show counter global' command to check for anomalies.

Answer

Use the 'show session id' command to view session details.

Answer

Use the 'test security-policy-match' command to check policy rules.

Question 3

A network security analyst is troubleshooting a connectivity issue where a client cannot access a web server. The analyst runs 'test security-policy-match' and finds that the traffic matches a rule that allows the application 'web-browsing'. However, the analyst notices that the rule has a 'URL Filtering' profile attached that blocks the 'malware' category. The analyst wants to verify whether the URL category of the web server is being correctly identified. Which CLI command should the analyst use to test the URL category for the web server?

Accepted Answer

test url <url>. To determine the URL category assigned to a specific web server, the analyst should use the 'test url' command. This command queries the URL filtering database and returns the category, helping the analyst confirm whether the 'malware' category block is appropriate. If the categorization is wrong, they can adjust the URL Filtering profile or request recategorization.

Answer

test security-policy-match

Answer

show system url-cache

Answer

show url-filtering

Question 4

A network security analyst is troubleshooting why a security policy is not matching traffic as expected. The analyst runs 'test security-policy-match' and sees that the traffic matches a policy, but the action is 'deny'. The analyst wants to see the exact rule that matched. Which field in the output should the analyst examine to identify the matching rule?

Accepted Answer

The 'rule' field showing the rule name.. The 'rule' field in the 'test security-policy-match' output directly provides the name of the security rule that matched the traffic. This is the quickest way to identify the rule responsible for the deny, enabling the analyst to review and adjust that rule as needed.

Answer

The 'application' field showing the identified application.

Answer

The 'action' field showing 'deny'.

Answer

The 'source' and 'destination' fields showing the matched addresses.

Question 5

A network security analyst is troubleshooting a site-to-site VPN tunnel that is showing as 'up' but no traffic is passing through it. The analyst wants to verify if the firewall is encrypting and decrypting packets correctly. Which tool should the analyst use to capture and examine the packets?

Accepted Answer

Use the packet capture feature with a filter for the VPN tunnel interface to inspect encrypted and decrypted packets.. When a VPN tunnel is up but no traffic passes, the analyst must verify that packets are being encrypted and decrypted. Packet capture on the tunnel interface allows examination of both the encrypted outer packets and the decrypted inner packets. This confirms whether the firewall is processing traffic correctly. Other options like checking status or logs do not provide direct evidence of packet flow.

Answer

Review the system logs for IKE negotiation errors.

Answer

Check the VPN status in the web interface to see if the tunnel is up.

Answer

Run a traceroute from a host behind the firewall to a remote host to see where packets are dropped.

Question 6

A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?

Accepted Answer

test security-policy-match. The 'test security-policy-match' command is designed to simulate a traffic flow and report the exact security policy rule that would be applied, including implicit deny rules. Since the traffic is not generating logs or sessions, this tool provides immediate insight into rule matching without generating actual traffic. It allows the analyst to verify zone, address, user, and application parameters to pinpoint why the intended rule is not matching.

Answer

show session all filter source <user-IP>

Answer

debug dataplane packet-diag set filter match source <user-IP>

Answer

show running security-policy

Question 7

A NetSec-Analyst is troubleshooting why a user cannot access a web application. The traffic is allowed by the security policy, but the application fails to load. The analyst suspects an issue with SSL decryption. Which two actions should the analyst take to verify that SSL decryption is functioning correctly for this traffic? (Choose two.)

Accepted Answer

Check the 'Decryption Log' for entries related to the user's session.. To verify SSL decryption for a specific traffic flow, the analyst should examine the Decryption Log for session details and use the 'test decryption-policy-match' command to confirm which decryption rule applies. The Decryption Log reveals if decryption was attempted and any errors, while the policy match test ensures the correct rule is matched. Together, they provide a clear picture of whether decryption is functioning as intended for that user's traffic.

Answer

Check the 'System Log' for SSL errors.

Answer

Verify that the forward trust certificate is installed and trusted by the client.

Answer

Run 'show session all filter application ssl' to see if the session is being decrypted.

Question 8

A network security analyst is investigating intermittent connectivity failures to an external SaaS application. Users report that sometimes the connection works, but other times it times out. The firewall is configured with a security policy that allows the SaaS application by its App-ID, and SSL decryption is enabled for the traffic. The analyst suspects that decryption is failing for some sessions. Which log should the analyst examine first to determine whether decryption is failing and why?

Accepted Answer

Decryption log. When SSL decryption is enabled and sessions fail intermittently, the Decryption log is the correct place to look. It records each decryption attempt and any error encountered, such as unsupported protocol versions, certificate issues, or policy bypass. This allows the analyst to pinpoint the exact cause of the intermittent failures, whether it is due to server-side certificate pinning, client certificate issues, or decryption profile settings.

Answer

System log

Answer

Threat log

Answer

Data Filtering log

Question 9

A network security analyst is troubleshooting a performance issue where throughput on a specific sub-interface is lower than expected. The analyst needs to monitor real-time throughput data for that sub-interface to determine if the interface is saturated. Which CLI command should the analyst use?

Accepted Answer

monitor interface ethernet1/1.100. The monitor interface command is designed for real-time throughput monitoring. It displays live statistics such as packets per second and bits per second for the specified interface, allowing the analyst to observe current utilization and identify saturation. Other commands provide cumulative counters or configuration details, which are not suitable for immediate throughput analysis.

Answer

show interface ethernet1/1.100

Answer

show interface ethernet1/1.100 throughput

Answer

show counter interface ethernet1/1.100

Question 10

A NetSec-Analyst is troubleshooting a connectivity issue between two internal subnets. The analyst suspects that the firewall is dropping packets due to a security policy. Which CLI command should the analyst use to view the security policy that is matching a specific flow?

Accepted Answer

test security-policy-match source 10.1.1.1 destination 10.2.2.2 protocol 6 destination-port 80. The 'test security-policy-match' command is designed to simulate a policy lookup for a specific flow, providing the matching rule and its action. This is the most efficient way to determine which security policy is affecting the traffic. Other commands either show session details without policy information or require manual inspection of the entire policy set, which is not practical for troubleshooting a specific connection.

Answer

show running security-policy

Answer

show session all filter source 10.1.1.1 destination 10.2.2.2

Answer

debug dataplane packet-diag set filter match source 10.1.1.1 destination 10.2.2.2

Question 11

A network security analyst is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing. The analyst wants to verify whether the firewall is encrypting and decrypting packets correctly. Which two CLI commands should the analyst use to check the VPN tunnel statistics and the status of the IPsec security associations? (Choose two.)

Accepted Answer

show vpn ipsec-sa detail. To verify that the firewall is encrypting and decrypting packets correctly, the analyst should check the IPsec security associations and their statistics. The 'show vpn ipsec-sa' command lists the SAs and their status, confirming that Phase 2 is established. The 'show vpn ipsec-sa detail' command provides packet and byte counters for encryption and decryption, showing whether traffic is actually being processed. Together, they pinpoint whether the tunnel is passing traffic and if there are errors in one or both directions.

Answer

show vpn tunnel

Answer

show vpn ike-sa

Answer

show vpn flow

Question 12

A network security analyst is troubleshooting connectivity issues between two internal subnets separated by a firewall. The analyst suspects that the firewall is dropping packets due to a security policy rule. Which CLI command should the analyst use to view the real-time packet drop counters for the firewall's dataplane?

Accepted Answer

show counter global filter delta yes. The 'show counter global filter delta yes' command is specifically designed to show changes in global counters, including packet drops, in real time. By using the delta option, the analyst can observe which drop counters are incrementing during the connectivity issue, quickly identifying the cause. Other commands either show static totals or lack the necessary drop detail, making them less effective for this troubleshooting scenario.

Answer

show interface all

Answer

show running global-counter

Answer

show session all

Question 13

A network security analyst is troubleshooting an issue where a user cannot access a website. The analyst suspects that the traffic is being denied by a security policy. Which CLI command should the analyst use to simulate the flow and see which security policy rule is matching?

Accepted Answer

test security-policy-match. The 'test security-policy-match' command is designed to simulate a flow and determine which security policy rule matches and what action is taken. By providing the source, destination, user, application, and service, the analyst can see the exact rule and whether it allows or denies the traffic. This directly answers why the user cannot access the website, as it will show if a deny rule is matching or if no rule matches and the default deny applies.

Answer

show running security-policy

Answer

debug dataplane packet-diag set filter match source <user-IP>

Answer

show session all filter source <user-IP>

Question 14

A network security analyst is troubleshooting an issue where a user cannot access an internal web server. The analyst suspects that the firewall is blocking the traffic. Which TWO actions should the analyst take to determine if a security policy rule is causing the block? (Choose two.)

Accepted Answer

Check the traffic logs filtered by the user's source IP and the server's destination IP.. The most direct methods to determine if a security policy rule is blocking traffic are to simulate the flow with 'test security-policy-match' and to examine traffic logs for the specific connection. The policy match command identifies the exact rule that would be applied, while logs provide evidence of actual denials. Together, they confirm whether a policy rule is the cause and which one, enabling targeted remediation.

Answer

Use 'show counter global filter delta yes' to look for packet drops.

Answer

Run 'show session all filter source destination ' to see if a session exists.

Answer

Run 'debug dataplane packet-diag set filter match source destination ' to capture packets.

Question 15

A network security analyst is investigating why a specific application is not being identified correctly by App-ID. The analyst wants to see the details of how the firewall classified the application for a particular session. Which CLI command should the analyst use to display the application identification details for an active session?

Accepted Answer

show session id . To see how the firewall classified an application for a specific session, the analyst should use the 'show session id ' command. This command provides a detailed breakdown of the session, including the identified application, its parent application, category, and the security policy that allowed it. It is the most accurate way to confirm the App-ID result for that session and understand why the application was identified as it was.

Answer

debug app-id session <session-id>

Answer

show session all filter application <app-name>

Answer

show application list