Network Security Fundamentals

You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?

An administrator wants to ensure that only 'web-browsing' traffic is allowed on port 80. Which feature allows this enforcement?

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?

You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?

Where do you configure a URL Filtering profile?

An administrator wants to use User-ID. What is the primary benefit of mapping IP addresses to usernames?

An administrator needs to restrict access to a specific website. Which profile should be modified?

Which feature allows the firewall to inspect encrypted traffic for threats?

Which action should be taken if you want to log traffic matching a specific policy?

What does the 'Zone Protection Profile' protect against?

You have a security policy that allows 'any' application. What is the security risk of this configuration?

When using App-ID, what happens if traffic matches a policy allowing 'web-browsing' but the application is actually 'facebook-base'?

An administrator wants to block a specific file type from being uploaded. Which profile is required?

Which plane on a Palo Alto Networks firewall is responsible for the web interface and CLI?

Which of the following is an example of a Security Profile?

What is the function of 'Application Default' in a service object?

Why should you use an App-ID 'Group' in a security policy?

Which TWO of the following are valid components of a PAN-OS Security Policy?

Which TWO settings are configurable within a URL Filtering profile?

Which THREE items are necessary for a properly configured Security Policy rule?

Which THREE of the following are valid Security Profile types?

Which THREE features are part of the Palo Alto Networks Single Pass Architecture?

Which TWO items can be used as match criteria in a Security Policy rule?

Which TWO of the following are required to enable full visibility into threats inside SSL traffic?

Which THREE of the following are consequences of enabling 'Log at Session End'?

A security engineer at a financial services company is designing segmentation for a new data center. The requirement is that the web tier (VLAN 20) must never initiate connections to the database tier (VLAN 30), but the database tier must be able to initiate connections to the web tier for replication. Which security policy configuration on a Palo Alto Networks firewall best enforces this requirement?

A network administrator is reviewing the TCP/IP model layers while troubleshooting a connectivity issue. The administrator needs to identify which layer is responsible for logical addressing and routing of packets across multiple networks. Which layer of the TCP/IP model performs this function?

A security analyst is investigating a series of alerts indicating that an internal host is communicating with a known malicious IP address. The analyst wants to verify whether the traffic was allowed by a specific security policy rule and determine the exact rule name that permitted the session. Which Palo Alto Networks feature should the analyst use to identify the rule that allowed the traffic?

A network security administrator is implementing a defense-in-depth strategy and needs to select controls that operate at the network layer to protect against IP spoofing and to segment traffic between VLANs. Which two controls should the administrator implement? (Choose two.)

A junior administrator is reviewing how a PAN-OS firewall handles a brand-new TCP session between a client in the Trust zone and a web server in the Untrust zone. They want to confirm which component performs the actual security policy lookup for that first packet before any session entry exists. Which component is responsible?

A security team is deploying a new internal application that uses a proprietary protocol over TCP port 8443. The team wants the firewall to inspect the application and enforce policy based on the application rather than just the port. Which Palo Alto Networks feature should be used to identify and control this application?

A security administrator is troubleshooting why a web server in the DMZ zone cannot be reached by external clients even though the inbound security policy permits the traffic. The administrator confirms that the DMZ interface has an IP address, the external interface has an IP address, and static routes exist in both directions. The web server's default gateway points to the firewall's DMZ interface. Which additional configuration is required for the firewall to translate the public destination address to the web server's private address?

A network engineer is designing a zero-trust micro-segmentation architecture for an east-west data center. The requirement is to enforce security policy between workloads on the same VLAN without routing traffic through a physical firewall appliance. Which technology should the engineer implement?

An analyst is investigating why a server in the DMZ zone can reach an external update site on TCP 443 even though no security rule explicitly permits that server's traffic. The firewall uses a security rule with the application set to 'ssl' and the service set to 'application-default'. Which behaviour explains the observed connectivity?

A network security team is designing segmentation for a new data center. They want to ensure that east-west traffic between application tiers is inspected and that any compromised host cannot freely reach other tiers. They plan to use security zones and security policies on their Palo Alto Networks firewalls. Which TWO design elements are required to enforce least-privilege east-west segmentation? (Choose two.)

A security analyst is reviewing a packet capture and notices that a single TCP session to a web server is being inspected, logged, and policy-checked only once, even though the session carries thousands of packets. Which security architecture principle does this behavior illustrate?

A security architect is hardening a PAN-OS firewall that protects a data center. The architect wants to reduce the attack surface exposed by the firewall's own management and control functions. Which TWO measures directly harden the management plane? (Choose two.)

A security analyst is reviewing a packet capture and observes that a single TCP SYN packet sent to a closed port on an internal server elicits a TCP RST response, while the same SYN sent to a filtered port receives no response at all. Which statement best describes what the analyst is observing?

A security operations analyst notices that a workstation in the trust zone is repeatedly attempting connections to an external IP address on TCP port 4444, a port commonly associated with remote access trojans. The security policy currently allows the workstation to reach any external destination on any port because of a legacy any-any outbound rule. The analyst wants to block this specific behavior without disrupting legitimate business traffic. Which action should the analyst take first?

A network security engineer is troubleshooting an intermittent issue where some users lose access to an internal application after a firewall policy change. Logs show the traffic is being dropped with a session end reason indicating the application was not identified. The rule in question uses App-ID with a specific application, and the service is application-default. Which condition most likely explains the drop?

A security team is deploying a new internal certificate authority for TLS inspection. They want to ensure that compromised private keys can be traced and that certificate issuance is cryptographically bound to a public, append-only log that monitors can audit. Which mechanism should they implement?

A company wants to prevent users from resolving domain names for known malicious command-and-control servers. The security team already subscribes to a threat intelligence feed that publishes malicious domains. Which control should be implemented to block DNS resolutions for those domains at the network level?

A NetSec-Pro administrator is configuring a new security policy to allow internal users to access a web server in a DMZ. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and that all other traffic is blocked. Which NetSec-Pro feature should be used to identify and control the application?

A security architect is reviewing a design where a Palo Alto Networks firewall will inspect traffic between two internal segments that are both connected to the same firewall. The architect wants to ensure that traffic between the segments is subject to security policy and threat inspection rather than being allowed implicitly. The two segments are currently assigned to different subnets but the same security zone. Which change is required to ensure interzone policy enforcement between the segments?

A network security administrator is hardening a new layer 2 switching infrastructure against common attacks. Which two measures should be implemented to prevent MAC flooding and DHCP spoofing attacks? (Choose two.)

A NetSec-Pro administrator is troubleshooting why a user cannot access a specific SaaS application. The security policy allows the application, but traffic is being denied. The administrator suspects that the application is being identified incorrectly. Which NetSec-Pro feature can be used to verify the application identification and take corrective action?

A network architect must choose an encryption mode for securing site-to-site traffic over an untrusted provider network. The requirement is to provide confidentiality and integrity for each packet independently, allow parallel processing, and avoid the need for sequential block chaining. Which mode should be selected?

A security team wants to detect command-and-control traffic that uses domain generation algorithms (DGAs) and DNS tunnelling. The firewall already performs DNS sinkholing for known malicious domains. Which two additional capabilities should the team enable to improve detection of these DNS-based threats? (Choose two.)

A NetSec-Pro administrator is configuring a security policy to allow access to a web application. The administrator wants to ensure that the policy enforces least privilege by restricting access to only the necessary users and applications. Which two NetSec-Pro features should be used together to achieve this? (Choose two.)

A network architect is designing segmentation for a data centre that hosts web, application, and database tiers. The requirement is to enforce policy based on workload identity that can move between hypervisors and physical hosts, without relying on IP addresses that change during live migration. Which segmentation approach best meets this requirement?

A NetSec-Pro administrator is configuring a security policy to allow inbound access to a web server in the DMZ. The administrator wants to ensure that the policy is as restrictive as possible. Which combination of settings should be used?

A security team is evaluating controls to detect and prevent IP spoofing at the network edge. Which TWO mechanisms are designed to validate the source address of packets and reduce spoofing? (Choose two.)

A security operations team notices that outbound sessions from internal hosts are being allowed to an external server on TCP port 443, but the firewall's threat logs show no inspection of the application data inside those sessions. The team confirms the traffic is not using a protocol that the firewall cannot decrypt. Which action should the team take to gain visibility into the content of these sessions?

A firewall administrator needs to allow a specific set of external partners to reach a web application while blocking all other internet sources. The partners' addresses change periodically, and the administrator wants to update the permitted list from a central management platform without editing the security rule each time. Which object type should the administrator use?

A network security engineer is configuring a Palo Alto Networks firewall to enforce least-privilege access for a group of contractors. The contractors must be able to reach only an internal web application over HTTPS. The engineer wants to avoid creating a new security policy that allows any other application. Which Palo Alto Networks feature should the engineer use to identify and control the HTTPS application?

A network security engineer is troubleshooting why a user cannot access a web application. The engineer checks the traffic logs and sees that the session is being denied by a security policy. The engineer suspects that the application is being identified incorrectly. Which tool should the engineer use to verify how the firewall is classifying the application in real time?