NetSec-Pro Practice Test 1 — 10 Questions

Question 1

Where do you configure a URL Filtering profile?

Accepted Answer

Objects > Security Profiles. URL Filtering profiles in Palo Alto Networks PAN-OS are configured under Objects > Security Profiles, alongside other security profiles like Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire Analysis. Once created there, the profile is applied to a Security policy rule. This location is consistent across PAN-OS versions and is where all reusable security profile objects live.

Answer

Policies > Security

Answer

Network > Profiles

Answer

Device > Setup

Question 2

A NetSec-Pro administrator is configuring a Security Policy rule to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the firewall identifies the application as web-browsing regardless of the port used. Which Security Policy rule component should be used to achieve this requirement?

Accepted Answer

Application. The Application field in a Security Policy rule leverages App-ID to classify traffic based on application signatures, not just ports. This allows the firewall to recognize web-browsing even on non-standard ports. The other fields (Service, Source Zone, Destination Address) are match criteria but do not provide application identification. Therefore, the Application field is the correct choice to meet the requirement.

Answer

Service

Answer

Destination Address

Answer

Source Zone

Question 3

A security operations team wants to receive alerts when the firewall detects a critical vulnerability exploit attempt. Which component should be configured to generate these alerts?

Accepted Answer

Vulnerability Protection profile. The Vulnerability Protection profile is specifically engineered to detect and prevent exploits that target software vulnerabilities. By configuring it to alert on critical severity events, the security team will receive notifications when such exploits are attempted. This profile inspects traffic for known exploit signatures and anomalies.

Answer

Antivirus profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 4

Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?

Accepted Answer

Commit Validation. The 'Commit Validation' or 'Pre-check' feature in SCM identifies potential issues before they are deployed.

Answer

Policy Optimizer

Answer

App-ID Dependency Check

Answer

Configuration Audit

Question 5

A network engineer is setting up a new Security Zone on a Palo Alto Networks firewall. The engineer wants to ensure that traffic entering this zone from any other zone is denied by default. Which action should be taken?

Accepted Answer

Ensure that no security policy rules exist that allow traffic to this zone from other zones.. Palo Alto Networks firewalls employ a default-deny security posture for inter-zone traffic. When a new zone is created, no traffic is allowed to or from it until a security policy rule explicitly permits it. Therefore, to ensure traffic entering the zone from other zones is denied, the engineer only needs to avoid creating allow rules. The default behavior takes care of the rest, making it a simple and secure starting point.

Answer

Create a security policy rule with source zone 'any' and destination zone 'any' with action 'deny'.

Answer

Set the zone's type to 'External' and enable 'Deny' in the zone properties.

Answer

Configure a Deny rule at the top of the security policy with source zone 'any' and destination zone 'any'.

Question 6

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

Accepted Answer

GlobalProtect app. The GlobalProtect app is necessary for remote users to connect and provide identity and posture information. Security policy rules with App-ID and User-ID are needed to enforce access control to SaaS applications based on user and application. Together, they enable threat inspection and identity-based control. The other options are either licensing, optional, or not applicable to mobile user connectivity.

Answer

Prisma Access service connection

Answer

Prisma Access mobile users license

Answer

Cloud Identity Engine

Question 7

A security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to block traffic and send a TCP reset to both the client and server. Which action should be selected?

Accepted Answer

Reset-Both. The Reset-Both action is designed to block traffic and send a TCP reset to both the client and the server. This immediately terminates the session on both ends. Deny sends a reset only to the client, Drop silently discards, and Reset-Client sends a reset only to the client. Therefore, Reset-Both is the correct action to meet the requirement of sending a TCP reset to both parties.

Answer

Drop

Answer

Deny

Answer

Reset-Client

Question 8

A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?

Accepted Answer

The security policy does not allow traffic from the VPN zone to the internal zone.. When a Site-to-Site VPN tunnel is up and routing is correct, the most common reason for traffic not passing is a missing or incorrect security policy. The firewall must have a policy allowing traffic from the VPN zone to the internal zone (and possibly the reverse). The default security policy denies all traffic, so without an explicit allow rule, packets are dropped. Administrators should check the security policy and ensure it matches the source and destination addresses and zones.

Answer

The tunnel interface is not assigned to a security zone.

Answer

The IKE gateway is configured with the wrong pre-shared key.

Answer

The IPsec proposal is misconfigured, causing the tunnel to flap.

Question 9

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

Accepted Answer

Network > Interface Management Profile. Management Profiles, applied to the physical interface, allow you to specify permitted IP addresses for administrative services.

Answer

Device > Administrators

Answer

Device > Setup > Session

Answer

Policies > Security

Question 10

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

Accepted Answer

Reset-Both informs the client and server that the connection is closed.. 'Drop' silently discards the packet, while 'Reset-Both' actively informs the sender and receiver that the connection is terminated.

Answer

Reset-Both is only for TCP, while Drop is only for UDP.

Answer

Drop is only available for inter-zone traffic.

Answer

Drop consumes more firewall CPU cycles.