Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?
Disable App-ID for this rule.
Increase the timeout settings on the zone.
Check the logs for the specific Security Profile trigger.
The traffic passes the Security Policy rule but fails a Security Profile, so the profile's log entry identifies which threat signature or filter triggered. Checking those logs satisfies the need to pinpoint the specific profile blocking access.
Change the application to 'any'.
You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?
Traffic Logs in Panorama
GlobalProtect App logs
Prisma Access Insights
Prisma Access Insights surfaces hop-by-hop path and latency telemetry between mobile users and Service Connections, exposing the specific segment causing SaaS slowness. This directly satisfies the requirement to analyse latency along that path rather than infer it from aggregate logs.
ACC (Application Command Center)
When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?
To cache user credentials for SSO.
To encrypt traffic for GlobalProtect.
To query domain controllers for IP-to-User mapping.
The User-ID Agent runs on domain controllers or Windows servers, querying Active Directory to build IP-to-user mappings and forwarding them to the firewall. This mapping lets security policy enforce identity rather than raw IP addresses.
To push security policies to clients.
Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?
Vulnerability Protection
URL Filtering
Data Filtering
Data Filtering inspects traffic content against defined patterns, such as credit card number formats, and blocks matching data from leaving the network. This directly addresses exfiltration of sensitive data, unlike antivirus, application control, or URL filtering, which target malware, applications, or web destinations respectively.
Antivirus
What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?
Reset-Both is only for TCP, while Drop is only for UDP.
Drop is only available for inter-zone traffic.
Drop consumes more firewall CPU cycles.
Reset-Both informs the client and server that the connection is closed.
Reset-Both sends TCP RST packets to both endpoints, actively tearing down the session and notifying each side, whereas Drop silently discards packets with no notification. This satisfies the stem by confirming that Reset-Both informs client and server the connection is closed.
You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?
The custom application lacks a defined signature to identify the application flow.
Without a signature, App-ID cannot match the application's traffic patterns, so sessions remain unidentified and are reported as incomplete. The custom application object must include a signature defining the protocol and port behaviour; otherwise non-standard ports prevent correct identification.
The security policy has not been committed to the Data Plane.
Content-ID is disabled on the Security Policy rule.
User-ID is not enabled on the ingress interface.
Want more NGFW And SASE Solution Functionality practice?
Practice this domainYou are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?
Packet Capture (pcap)
GlobalProtect logs
Policy Test Tool (test security-policy-match)
The Policy Test Tool (test security-policy-match) simulates a flow against the rulebase and returns the exact matching rule, including shadowed or preceding rules. Packet captures and logs show traffic behaviour but not rule precedence, so this tool satisfies the need to identify the specific rule.
Traffic Monitor
An administrator wants to ensure that only 'web-browsing' traffic is allowed on port 80. Which feature allows this enforcement?
App-ID
App-ID inspects the application payload to distinguish web-browsing from other applications tunnelling over port 80, so policy matches on the actual application rather than the port alone. This enforces the stem's requirement that only web-browsing is permitted.
Zone Protection Profiles
Service Objects
Log Forwarding
Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?
Application Group
Tag
Address Group
An Address Group is a PAN-OS object that aggregates multiple IP addresses, static or dynamic, into a single named reference usable in security policy rules. This satisfies the requirement to group many addresses so one policy entry covers them all, rather than listing each address individually.
Service Group
You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?
The dependent application, such as 'ssl', is not allowed in the policy.
Web-browsing depends on the ssl application for HTTPS traffic, so the firewall denies the session when ssl is absent from the allowed applications. Palo Alto Networks resolves applications with dependencies before matching; permitting only web-browsing leaves the encrypted flow unmatched, satisfying the stem's denial despite the policy match.
The source zone is incorrect.
The firewall is in transparent mode.
The security profile is missing.
When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?
Deny all traffic by default.
Zero Trust assumes no implicit trust between zones, so the default interzone policy should deny all traffic, with access granted only through explicit rules. This satisfies the stem's requirement for the recommended default stance in that deployment model.
Allow all internal traffic, deny external.
Allow traffic based on source IP only.
Allow all traffic to simplify configuration.
You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?
Use the 'intrazone-default' policy to automatically allow traffic to all servers.
Define a specific Address Object for the destination server and bind it to the correct zone.
Binding a specific Address Object for the destination server to the correct zone restricts the rule to that host, satisfying least privilege. Referencing any or broad subnets would permit unnecessary destinations, contradicting the stem's stated principle.
Set destination zone to 'any' and destination address to 'any' to ensure traffic flow.
Configure the security policy to reference the interface IP rather than an Address Object.
Want more Network Security Fundamentals practice?
Practice this domainYou are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?
Configuration logs
Threat logs
Traffic logs
System logs
System logs capture the management-plane tunnel to Microsoft Entra ID and SCM, recording control-channel events, certificate and authentication failures, and heartbeat status. This satisfies the stem's need for the most detailed view of the management connection, unlike traffic or threat logs, which cover dataplane sessions.
When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?
Device Groups
Device Groups in Panorama let administrators bundle firewalls sharing policy requirements, then push rulebases to those groups. Grouping by geographical location satisfies the requirement to target specific firewalls by region rather than pushing to all managed devices.
Panorama Templates
Address Groups
Policy Groups
When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?
It is automatically moved to SCM storage.
It is purged immediately upon successful migration.
It is exported as a CSV file to the administrator's desktop.
It remains on the Panorama appliance and must be archived manually.
Panorama's log database is not migrated to SCM; only configuration and policy objects transfer. Logs remain in the Panorama log store, so they must be exported or archived manually before decommissioning the appliance if retention is required.
An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?
The Panorama license has expired.
The Template Stack order is incorrectly configured, causing overlapping values.
Template stacks apply settings in order; conflicts occur when multiple templates in the stack define the same parameter.
The firewall is in maintenance mode.
The device group is locked by another administrator.
Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?
Policy Optimizer
Commit Validation
Commit Validation inspects the candidate configuration against security best-practice checks before the commit completes, flagging non-compliant settings such as weak management access or missing threat profiles. This directly satisfies the stem's requirement to verify compliance prior to pushing changes to devices, preventing policy drift without manual review.
App-ID Dependency Check
Configuration Audit
Where do you generate a 'Device Deployment' token for adding a new firewall to Strata Cloud Manager?
Customer Support Portal
Local Firewall CLI
SCM Inventory/Device Management
Device Deployment tokens are issued from SCM Inventory/Device Management, where onboarding credentials for new firewalls are generated. This is the only area that produces the token required to register a firewall with Strata Cloud Manager.
Panorama Settings
Want more Platform Solutions Services And Tools practice?
Practice this domainAn administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?
Decrease the MTU size on the tunnel interface.
Lowering the tunnel interface MTU prevents IPv6 packets from exceeding the path MTU between the GlobalProtect gateway and remote clients, avoiding silent drops where ICMPv6 "Packet Too Big" messages are blocked. This directly addresses the fragmentation-suspected packet loss constraint by forcing endpoints to send smaller packets that traverse the tunnel without fragmentation.
Increase the GlobalProtect timeout value.
Disable hardware offloading for IPv6.
Enable IPv6 transition mechanisms on the external interface.
An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?
Objects > Addresses
Network > GlobalProtect > Gateways > Client Settings
This is the correct navigation path to define client IP assignment.
Network > DHCP > Server
Device > Setup > Management
Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?
debug dataplane packet-diag
test security-policy-match source <ip> destination <ip> protocol <proto>
This command correctly simulates traffic flow against the policy database.
show running security-policy
show session all filter source <ip>
When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?
Traffic logs
System logs
System logs capture BGP neighbour state transitions and notification messages, satisfying the requirement to observe peering changes. Routing protocol events surface here rather than in traffic, threat, or configuration logs, so they reveal why the session flapped or failed to establish with the ISP.
Threat logs
Config logs
An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?
Configure the tunnel interface in a separate security zone.
Change the tunnel interface type to Layer 3.
Enable Proxy-ID settings on the tunnel interface.
Add a static route in the Virtual Router pointing to the remote subnet using the tunnel interface as the next hop.
A static route in the Virtual Router pointing to the remote subnet with the tunnel interface as next hop installs the tunnel into the routing table, so traffic is forwarded across it. This satisfies the stem's requirement that the tunnel interface be routable.
Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?
System Logs
Threat Logs
Config Logs
Config Logs record administrative changes to firewall settings, capturing who altered the configuration and what was modified. Filtering this log type isolates configuration changes, whereas traffic, threat or system logs would not show the administrator's edits.
Traffic Logs
Want more Connectivity And Security practice?
Practice this domainYou are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?
The Security Policy is missing a Decryption Profile.
The App-ID database is outdated.
The client sent a SYN packet but the server did not respond.
An 'incomplete' App-ID means the firewall saw the session's initial packet but insufficient application data to identify it. A SYN sent with no server response leaves the handshake unfinished, so no payload arrives for App-ID to match, and the session is denied.
The application is using a custom port not defined in the Service object.
Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?
Authentication Portal
MFA Profile
A Microsoft Entra ID MFA profile enforces a second authentication factor, so a stolen password alone cannot grant access. This directly satisfies the stem's constraint of blocking unauthorised use of a compromised credential, since the attacker lacks the registered second factor (phone app, token, or biometric).
Credential Protection Profile
GlobalProtect Authentication Override
An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?
Static NAT
Double NAT
Destination NAT
Source NAT
Source NAT rewrites the packet's source address on egress, so internal private IPs are translated to the firewall's public address before reaching the internet. This directly satisfies the requirement to hide private addresses whilst preserving outbound connectivity for internal users.
You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?
The application signature does not match the traffic's port or pattern.
A custom application object only matches traffic whose signature, port, and pattern align with the defined parameters. If the signature does not match the actual traffic, the policy never identifies the application, so the implicit deny rule blocks it.
The application must be assigned to the 'web' category.
The App-ID must be added to a service group.
The application requires an SSL decryption policy first.
You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?
Network > GlobalProtect
Objects > External Dynamic Lists
Device > Software
Device > Setup > Operations
Scheduled configuration backups, including SCP export to an external server, are configured under Device > Setup > Operations, which hosts configuration backup and restore tasks. This path satisfies the requirement to schedule exports to a remote server.
Where do you navigate in PAN-OS to update the App-ID and Threat signatures to the latest versions?
Device > Dynamic Updates
Device > Dynamic Updates is the dedicated PAN-OS pane for retrieving and installing content releases, including App-ID and Threat signature packages, from Palo Alto Networks update servers. It satisfies the stem's requirement to locate where signature versions are refreshed, offering scheduled or manual installation of the latest content.
Network > Interfaces
Objects > Applications
Policies > Security
Want more NGFW And SASE Solution Maintenance And Configuration practice?
Practice this domainWhat is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?
To encrypt DNS traffic between the firewall and the ISP.
To allow a firewall to act as a DNS server for internal clients.
To cache DNS queries to improve network performance.
To redirect requests for malicious domains to a specific IP address to alert the administrator.
DNS sinkholes intercept queries for known-malicious domains and return a controlled IP address instead of the real one, blocking the connection. Redirecting to a specific address satisfies the alerting requirement, since the administrator can monitor hits to that sinkhole and identify infected hosts.
You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?
Add the site to the 'Allow List' in the URL Filtering profile object assigned to the security policy.
Adding the site to the Allow List within the URL Filtering profile creates a URL-category override that takes precedence over the Newly Registered Domains category match, permitting that specific site while the profile continues blocking all other newly registered domains. This satisfies the stem's requirement to allow one site without weakening the broader policy.
Move the security policy to the top of the policy list.
Add the site to the 'Blocked' list in the URL Filtering profile.
Create a new URL category and add the domain to it, then block that category.
A company is experiencing high false-positive rates with WildFire for custom proprietary executable files. What is the recommended configuration to minimize these while maintaining security?
Lower the threat prevention action from block to alert for all executables.
Disable WildFire on the specific security policy rule.
Create a WildFire analysis profile and add the proprietary file hashes to the WildFire File Exclusion list.
Adding proprietary hashes to the WildFire File Exclusion list prevents those known-good executables from being submitted for cloud analysis, directly reducing false positives. A WildFire analysis profile scopes the exclusion to the relevant traffic, preserving inspection of all other files, so security coverage remains intact for unknown threats.
Change the WildFire forwarding location to a local WildFire appliance.
An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?
By manually downloading the threat signature database from the Customer Support Portal.
Through the scheduled 'Threats' dynamic update package.
Threat Prevention signatures, including protections for newly identified zero-day exploits, arrive via the scheduled 'Threats' dynamic update package. Installing this package delivers the updated signature set to the firewall, enabling enforcement against the specific exploit.
Through the daily WildFire update package.
By enabling the 'Automatic Update' feature in the Device > Software menu.
You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?
It analyzes the URL to determine if it is a known malicious site.
It detects and blocks the submission of enterprise credentials to untrusted or newly registered websites.
Credential Phishing prevention inspects outbound form submissions, detecting when corporate credentials are entered on untrusted or newly registered sites and blocking that submission. This satisfies the requirement to stop credential theft at the point of entry rather than merely filtering URLs.
It requires an agent installed on the endpoint to monitor browser activity.
It monitors all inbound traffic for known phishing signatures.
How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?
It provides real-time, cloud-based analysis of unknown or newly registered domains.
Advanced URL Filtering queries Palo Alto's cloud service in real time for unknown or newly registered domains, returning a verdict rather than relying solely on locally cached categories. This satisfies the stem's improvement requirement by catching domains that standard URL Filtering has not yet classified.
It allows the firewall to bypass SSL decryption for certain categories.
It includes an integrated VPN client for remote workers.
It allows for more custom URL categories.
Want more Infrastructure Management And CDSS practice?
Practice this domainThe vendor does not publish an exact question count for the NetSec-Pro. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: NGFW And SASE Solution Functionality, Network Security Fundamentals, Platform Solutions Services And Tools, Connectivity And Security, NGFW And SASE Solution Maintenance And Configuration, Infrastructure Management And CDSS. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks NetSec-Pro exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.