NetSec-Pro Practice Test 12 — 15 Questions

Question 1

A security team is deploying Prisma Access for remote users and wants to ensure that traffic to sanctioned SaaS applications is inspected for data loss while traffic to unsanctioned SaaS is blocked. They also need to apply different inspection profiles based on user group. Which combination of Prisma Access and NGFW features should they use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma Access with App-ID, SaaS tenant restrictions, and Security policy rules scoped by user group. The requirements are to inspect sanctioned SaaS for data loss, block unsanctioned SaaS, and apply different profiles by user group. Prisma Access with App-ID provides application identification, SaaS tenant restrictions control which tenants are reachable, and Security policy rules scoped to user groups allow different inspection profiles. This combination delivers the needed granularity and enforcement. URL categories, split tunneling, HIP profiles, and standalone File Blocking do not offer the same application-aware, group-based SaaS control.

Answer

Prisma Access with a custom URL category for each SaaS application and a single Security policy rule

Answer

GlobalProtect with split tunneling and a URL Filtering profile

Answer

GlobalProtect with HIP profiles and a File Blocking profile

Question 2

A network engineer is designing a zero-trust micro-segmentation architecture for an east-west data center. The requirement is to enforce security policy between workloads on the same VLAN without routing traffic through a physical firewall appliance. Which technology should the engineer implement?

Accepted Answer

Software-defined networking with a distributed virtual firewall. Micro-segmentation for east-west traffic without routing through a physical appliance is achieved with a distributed virtual firewall tied to SDN. This enforces policy at the workload's virtual interface, supports identity and application context, and centralizes management. The other choices either operate only at the access edge, lack centralized policy, or provide only static Layer 2 isolation.

Answer

Host-based firewall rules on each workload's operating system

Answer

802.1X port-based network access control on the data center switches

Answer

Private VLANs configured on the top-of-rack switches

Question 3

A security analyst is reviewing a packet capture and notices that a single TCP session to a web server is being inspected, logged, and policy-checked only once, even though the session carries thousands of packets. Which security architecture principle does this behavior illustrate?

Accepted Answer

Stateful inspection with session-based policy enforcement. The behavior described is session-based, stateful enforcement: the first packet creates a session, the policy is evaluated once, and subsequent packets are matched to that session. Stateless filtering would check every packet, while DPI and proxying describe inspection depth or connection handling rather than the single policy evaluation per session.

Answer

Stateless packet filtering with per-packet access control lists

Answer

Proxy-based inspection that terminates and re-originates each connection

Answer

Deep packet inspection that reassembles and scans every payload

Question 4

A network security team is designing segmentation for a new data center. They want to ensure that east-west traffic between application tiers is inspected and that any compromised host cannot freely reach other tiers. They plan to use security zones and security policies on their Palo Alto Networks firewalls. Which TWO design elements are required to enforce least-privilege east-west segmentation? (Choose two.)

Accepted Answer

Create explicit allow rules between tiers that specify only the required applications and services. Least-privilege east-west segmentation requires that traffic between tiers crosses a policy enforcement point and that only approved flows are allowed. Placing each tier in its own zone forces interzone evaluation, and explicit allow rules limited to required applications and services ensure that a compromised host cannot move laterally to unrelated tiers.

Answer

Enable a single any-any allow rule between all internal zones to simplify management

Answer

Rely on the default intrazone allow behavior to permit necessary tier communication

Answer

Configure all tiers to use the same subnet and VLAN to reduce routing complexity

Question 5

A network security engineer is troubleshooting an intermittent issue where some users lose access to an internal application after a firewall policy change. Logs show the traffic is being dropped with a session end reason indicating the application was not identified. The rule in question uses App-ID with a specific application, and the service is application-default. Which condition most likely explains the drop?

Accepted Answer

The application identification did not complete within the allowed number of packets, so the session was denied. App-ID requires enough packets to positively identify an application. When identification does not complete within the configured threshold, the firewall can deny the session, producing the unidentified-application drop reason. The intermittent pattern fits flows where identification timed out or was inconclusive.

Answer

The users are authenticating to the application with credentials that are not mapped by User-ID

Answer

The application is using a port that is not included in the application's default port list

Answer

The security rule's service was set to application-default, which disables App-ID inspection entirely

Question 6

A network security administrator is hardening a new layer 2 switching infrastructure against common attacks. Which two measures should be implemented to prevent MAC flooding and DHCP spoofing attacks? (Choose two.)

Accepted Answer

Enable port security with a maximum MAC address limit on access ports. Port security caps learned MAC addresses per port and stops CAM table overflow, which is the core of MAC flooding. DHCP snooping with trusted server ports blocks rogue DHCP offers that would enable spoofing. Storm control, BPDU guard, and private VLANs address broadcast suppression, spanning tree attacks, and lateral movement respectively, not the two threats named.

Answer

Configure storm control to limit broadcast traffic on all uplinks

Answer

Configure private VLANs to isolate all user ports from each other

Answer

Enable BPDU guard on all access ports connected to end devices

Question 7

A security team wants to detect command-and-control traffic that uses domain generation algorithms (DGAs) and DNS tunnelling. The firewall already performs DNS sinkholing for known malicious domains. Which two additional capabilities should the team enable to improve detection of these DNS-based threats? (Choose two.)

Accepted Answer

DNS Security with predictive analysis to identify domains that are likely generated by DGAs.. DNS Security combines predictive analysis that scores likely DGA-generated domains with tunnelling detection that inspects query length, volume, and entropy. Together they extend protection beyond static sinkholing, which only covers known malicious domains. Enabling both capabilities gives the team coverage for the two DNS-based command-and-control techniques described in the scenario.

Answer

A URL Filtering profile with the 'hacking' category set to block.

Answer

An Antivirus profile with wildcard signatures for known malware families.

Answer

A File Blocking profile that blocks executable files from unknown sources.

Question 8

A network security administrator needs to ensure that the Palo Alto Networks firewall can resolve domain names for security policy enforcement. Which service should be configured on the firewall?

Accepted Answer

DNS Client. The DNS Client service is responsible for resolving domain names for the firewall itself. This is necessary for various features, including URL filtering and security policy enforcement based on domain names. The other options are either client-facing services or security features that do not provide resolution.

Answer

DNS Proxy

Answer

DNS Sinkhole

Answer

DNS Security

Question 9

A network architect is designing segmentation for a data centre that hosts web, application, and database tiers. The requirement is to enforce policy based on workload identity that can move between hypervisors and physical hosts, without relying on IP addresses that change during live migration. Which segmentation approach best meets this requirement?

Accepted Answer

Dynamic Address Groups populated by tags from a workload registry or orchestration platform.. Dynamic Address Groups let policy reference workload tags supplied by a registry or orchestration platform, so group membership tracks the workload as it moves. Because the tag, not the IP address, drives enforcement, live migration across hypervisors and physical hosts does not disrupt or weaken the security policy, meeting the identity-based segmentation requirement.

Answer

Port-based Access Control Lists applied on the data centre's top-of-rack switches.

Answer

VLAN segmentation with inter-VLAN routing policed by a central firewall.

Answer

Static IP-based security zones with policy rules that reference subnet ranges.

Question 10

A security engineer is configuring a NetSec-Pro appliance to forward logs to an external SIEM using syslog. The SIEM requires that logs be sent over TCP with TLS encryption for compliance. The engineer configures a syslog server profile with the SIEM's IP address and port 6514, and selects 'SSL' as the transport. However, the SIEM is not receiving any logs. Which of the following is the most likely cause of the failure?

Accepted Answer

The syslog server profile requires a certificate to be imported and associated for TLS to function, and this step was omitted.. TLS-encrypted syslog requires a certificate on the sending device to establish a secure connection. Without importing and associating a certificate in the syslog server profile, the NetSec-Pro appliance cannot initiate the TLS handshake, so logs are not transmitted. The port and protocol selections are correct, but the missing certificate is the likely cause.

Answer

The NetSec-Pro appliance does not support TLS encryption for syslog; it only supports UDP and TCP without encryption.

Answer

Port 6514 is not a valid port for syslog over TLS; the correct port is 514.

Answer

The SIEM must be configured to accept syslog over UDP because NetSec-Pro only supports UDP for external log forwarding.

Question 11

A security team is evaluating controls to detect and prevent IP spoofing at the network edge. Which TWO mechanisms are designed to validate the source address of packets and reduce spoofing? (Choose two.)

Accepted Answer

Ingress and egress filtering based on assigned address space. Strict uRPF validates that the source address is reachable via the same interface, dropping spoofed packets, while BCP 38 ingress and egress filtering drops packets with source addresses outside the legitimate range. IPsec transport mode, SYN cookies, and DNS Response Policy Zones address confidentiality, SYN floods, and DNS policy respectively, not source-address validation.

Answer

TCP SYN cookies on public-facing servers

Answer

DNS Response Policy Zones on recursive resolvers

Answer

IPsec transport mode between edge routers

Question 12

A security operations team notices that outbound sessions from internal hosts are being allowed to an external server on TCP port 443, but the firewall's threat logs show no inspection of the application data inside those sessions. The team confirms the traffic is not using a protocol that the firewall cannot decrypt. Which action should the team take to gain visibility into the content of these sessions?

Accepted Answer

Enable SSL Forward Proxy decryption for the outbound traffic and attach security profiles to the allowing rule.. Outbound TLS sessions from internal hosts are best decrypted with SSL Forward Proxy, which positions the firewall between the client and the external server and exposes the application data to security profiles. Combining the decryption policy with profile attachment on the allowing rule ensures the decrypted content is inspected rather than merely decrypted.

Answer

Apply an SSL Decryption policy that forwards the traffic to a forward proxy for inspection.

Answer

Configure a Decryption profile that blocks sessions with untrusted issuers.

Answer

Enable SSL Inbound Inspection on the internal server that terminates the TLS session.

Question 13

A firewall administrator needs to allow a specific set of external partners to reach a web application while blocking all other internet sources. The partners' addresses change periodically, and the administrator wants to update the permitted list from a central management platform without editing the security rule each time. Which object type should the administrator use?

Accepted Answer

An External Dynamic List referenced as the source in the security rule.. An External Dynamic List is designed for address sets that change over time and are maintained outside the firewall. The firewall imports the list on a schedule, so updating the hosted file refreshes the permitted partner sources without editing the security rule. This provides the central management and dynamic membership the administrator needs.

Answer

A static Address Object for each partner, added to an address group in the rule.

Answer

A Dynamic Address Group based on tags registered by the partners' systems.

Answer

A URL Category object that lists the partners' public web addresses.

Question 14

A network security administrator is configuring a firewall to forward logs to an external syslog server. The syslog server uses a non-standard port and requires TCP for reliability. Which log forwarding destination configuration should the administrator use?

Accepted Answer

Configure a Syslog server profile with the server address, TCP port, and transport set to TCP.. To forward logs to an external syslog server on a non-standard port using TCP, the administrator must create a Syslog server profile. This profile defines the server address, port, and transport protocol. Once created, it can be selected as a log forwarding destination for the relevant log types. Other server profile types serve different purposes and do not support syslog over TCP.

Answer

Configure an Email server profile with the syslog server address and port.

Answer

Configure an HTTP server profile with the syslog server address and port.

Answer

Configure a Netflow server profile with the syslog server address and port.

Question 15

A security administrator is configuring a Site-to-Site VPN with a partner organization. The partner uses a policy-based VPN, while your organization uses a route-based VPN with a tunnel interface. The tunnel is up, but traffic is not passing. The administrator confirms that the proxy IDs match on both sides. What is the most likely cause of the issue?

Accepted Answer

The route-based VPN requires a static route pointing to the tunnel interface for the remote subnet.. When interconnecting a policy-based VPN with a route-based VPN, the route-based side must have a route that directs traffic for the remote subnet out the tunnel interface. Without this route, the firewall will use its default route and send traffic unencrypted, or drop it. The policy-based side may still initiate the tunnel based on proxy IDs, but return traffic will not find its way back. Adding a static route for the remote subnet with the tunnel interface as the next hop resolves the issue.

Answer

The tunnel interface is not assigned to a security zone.

Answer

The IKE gateway is configured with the wrong pre-shared key.

Answer

The proxy IDs are not configured correctly on the route-based VPN.