NetSec-Pro Practice Test 13 — 15 Questions

Question 1

Which object type allows you to group multiple IP addresses into a single entity for use in security policies?

Accepted Answer

Address Group. An Address Group is a named collection of IP addresses (individual hosts, subnets, or ranges) that can be referenced as a single source or destination in security policies. This simplifies policy management by allowing you to apply rules to multiple addresses without listing each one individually. Other object types serve different purposes: Service Objects define ports/protocols, Application Groups categorize applications, and Region Objects represent geographic locations.

Answer

Service Object

Answer

Application Group

Answer

Region Object

Question 2

A security operations team is using Strata Cloud Manager to monitor firewall health. They want to receive alerts when a managed firewall's CPU utilization exceeds 80% for more than 10 minutes. Which Strata Cloud Manager capability should they configure?

Accepted Answer

AIOps alerts. AIOps in Strata Cloud Manager offers advanced monitoring and alerting for the health and performance of managed firewalls. It allows administrators to define alert policies with specific conditions, such as CPU utilization exceeding a threshold for a sustained period. When triggered, alerts can be sent via email, SNMP, or integrated ticketing systems. Other features like Policy Optimizer or Traffic Logs do not provide this health monitoring and alerting functionality.

Answer

Policy Optimizer

Answer

Security Profiler

Answer

Traffic Logs

Question 3

A security administrator is troubleshooting why a user's GlobalProtect connection is failing. The user can authenticate successfully, but the GlobalProtect client shows 'Connected' yet cannot access internal resources. The administrator checks the GlobalProtect Gateway configuration and sees that the tunnel interface is configured with an IP address and the client IP pool is set. What is the most likely cause of the issue?

Accepted Answer

The security policy allowing traffic from the GlobalProtect zone to the internal zone is missing or misconfigured.. When a GlobalProtect user connects successfully but cannot access internal resources, the most common cause is a missing or incorrect security policy. The firewall must have a policy allowing traffic from the GlobalProtect zone to the internal zones. The default security policy denies all traffic not explicitly allowed. Administrators should check the policy rules and ensure the source zone is the GlobalProtect tunnel zone and the destination zone is the internal resource zone.

Answer

The firewall's management interface is not configured to allow GlobalProtect connections.

Answer

The GlobalProtect client is not receiving a DNS server address from the gateway.

Answer

The GlobalProtect Gateway is not configured with a certificate for SSL/TLS.

Question 4

In Prisma Access, what is the role of the 'Compute Location' setting?

Accepted Answer

It determines the data center region for policy enforcement.. In Prisma Access, the 'Compute Location' setting determines the data center region where security policy is enforced for mobile users and remote networks. It specifies the geographic location of the Prisma Access compute nodes that process traffic, ensuring compliance with data residency requirements and optimal performance.

Answer

It limits the bandwidth available to a user.

Answer

It defines the GlobalProtect Gateway IP.

Answer

It sets the user's home location for accounting.

Question 5

Which TWO of the following are required to enable full visibility into threats inside SSL traffic?

Accepted Answer

Security Profile (e.g., Anti-Virus). Option D, SSL Decryption Policy, is required because Palo Alto Networks firewalls cannot inspect the contents of TLS/SSL-encrypted sessions unless a decryption policy matches the traffic and instructs the firewall to decrypt it (using forward proxy or inbound inspection), thereby exposing the plaintext for inspection. Option B, Security Profile (e.g., Anti-Virus), is required because once the SSL session is decrypted, a security profile such as Anti-Virus, Anti-Spyware, Vulnerability Protection, or URL Filtering must be attached to the allowing security rule to actually detect and block threats in that now-visible traffic. Option A, GlobalProtect Portal, is not required—it provides remote user VPN connectivity and configuration, not SSL decryption or threat inspection. Option C, Device Certificate, is not required—a forward trust/forward untrust certificate (or a CA certificate for inbound inspection) is used for decryption, but the device certificate itself is not a prerequisite for SSL visibility. Option E, External Logging server, is not required—logging destinations such as Panorama, syslog, or Cortex Data Lake are optional for retention and analysis, not for enabling visibility into SSL traffic.

Answer

GlobalProtect Portal

Answer

Device Certificate

Answer

External Logging server

Question 6

Which action should be taken if you want to log traffic matching a specific policy?

Accepted Answer

Enable logging in the 'Actions' tab of the Security Policy.. In Palo Alto Networks firewalls, logging is configured per security policy rule, not globally or on zones/interfaces. The 'Actions' tab of a Security Policy rule contains the Log Setting options (e.g., Log at Session End, Log at Session Start). Enabling logging there ensures that only traffic matching that specific policy is logged, which is exactly what the question asks for.

Answer

Enable logging in the Zone object.

Answer

Enable logging in the Device settings.

Answer

Enable logging in the Interface settings.

Question 7

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

Accepted Answer

Check the logs for the specific Security Profile trigger.. The logs already show the traffic is correctly identified as 'web-browsing', so the failure is not an App-ID issue. The next diagnostic step is to inspect the Security Profile logs to see which specific profile (e.g., Antivirus, Vulnerability, URL Filtering) triggered the block. This allows the administrator to adjust the profile or create an exception without weakening the overall policy.

Answer

Disable App-ID for this rule.

Answer

Increase the timeout settings on the zone.

Answer

Change the application to 'any'.

Question 8

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Accepted Answer

Add a 'No Decrypt' rule matching the 'financial-services' URL category.. In an SSL Decryption policy, you can create rules to selectively bypass decryption for specific traffic. To exclude financial websites, you add a 'No Decrypt' rule that matches the URL category 'financial-services'. This ensures that traffic to those sites is not decrypted, complying with privacy laws. The rule is processed in order, so placing it before any decrypt rules ensures it takes effect.

Answer

Configure a separate decryption broker.

Answer

Disable decryption for the entire zone.

Answer

Delete the financial sites from the allowed list.

Question 9

A NetSec-Pro administrator is troubleshooting a SASE deployment where remote users report slow access to SaaS applications. The administrator suspects that traffic is being backhauled to the data center instead of going directly to the internet. The organization uses a SASE solution with a cloud secure web gateway (SWG) and SD-WAN. Which action should the administrator take to ensure that SaaS traffic is routed directly to the internet while still being inspected by the SWG?

Accepted Answer

Enable local internet breakout with cloud SWG integration in the SASE management console.. To reduce latency and avoid backhauling, SaaS traffic should break out locally at the branch while still being inspected by the cloud SWG. Enabling local internet breakout with cloud SWG integration in the SASE management console achieves this by directing traffic directly to the internet and transparently steering it to the SWG for security inspection. This combines performance optimization with consistent security enforcement.

Answer

Configure a policy-based forwarding rule to send SaaS traffic to the local internet breakout.

Answer

Apply an application override policy to force SaaS traffic through the data center proxy.

Answer

Create a static route for SaaS IP ranges pointing to the data center VPN tunnel.

Question 10

A network administrator is configuring a firewall to perform decryption of outbound SSL traffic to inspect for threats. The administrator wants to ensure that traffic to certain categories, such as financial services, is not decrypted due to privacy concerns. Which configuration should be used to achieve this?

Accepted Answer

Create a Decryption policy rule with a URL category of 'financial-services' and set the action to 'no-decrypt'.. To prevent decryption of traffic to financial services while still decrypting other outbound SSL traffic, a Decryption policy rule must be created with the URL category 'financial-services' and the action set to 'no-decrypt'. This rule should be ordered before any decryption rule that would otherwise match the traffic.

Answer

Create a Security policy rule with a URL category of 'financial-services' and set the action to 'allow'.

Answer

Configure an SSL Decryption Exclusion in the Decryption profile.

Answer

Enable 'No Decrypt' in the Decryption profile and apply it to the security policy rule.

Question 11

A NetSec-Pro administrator is configuring a firewall to block known malicious IP addresses. The administrator wants to use a dynamically updated list that is automatically populated from a threat intelligence feed. Which feature should be used?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List (EDL) is the correct feature to dynamically import IP addresses from an external threat intelligence feed. The firewall can be configured to poll the EDL server periodically, and the list can be referenced in security policies. This allows automatic updates without manual intervention. Other options do not provide the same dynamic IP list functionality.

Answer

Dynamic Address Group with a URL category

Answer

DNS Security profile with a custom feed

Answer

Static Address Group with manually added IPs

Question 12

A security administrator is configuring a Security Profile to protect against unknown threats. The administrator wants to ensure that files downloaded from the internet are analyzed for malicious behavior and that zero-day exploits are detected. Which Security Profile component should be configured?

Accepted Answer

WildFire Analysis. WildFire Analysis is the correct component because it performs dynamic analysis of files in a sandbox environment, detecting unknown threats and zero-day exploits. Antivirus, Anti-Spyware, and Vulnerability Protection are signature-based and cannot identify previously unknown malicious files. WildFire provides the necessary behavioral analysis to meet the administrator's goal.

Answer

Vulnerability Protection

Answer

Anti-Spyware

Answer

Antivirus

Question 13

Which action in a Security Profile allows you to permit traffic but generate an alert in the logs?

Accepted Answer

Alert. In a Security Profile, the 'Alert' action allows the traffic to pass but generates a log entry for the event. This is useful for monitoring and testing without blocking legitimate traffic. The other actions either block or reset the connection.

Answer

Reset-Server

Answer

Drop

Answer

Allow

Question 14

Which TWO items can be used as match criteria in a Security Policy rule?

Accepted Answer

Source Zone. In a Security Policy rule, the Source Zone (option B) is a valid match criterion because it identifies the ingress security zone from which traffic originates, allowing the firewall to apply policy based on the zone the packet enters. The Application (option D) is also a valid match criterion because next-generation firewalls can identify the application via App-ID and enforce policy based on that identification, rather than relying solely on port or protocol. Options A (Hardware Temperature), C (Management Plane Load), and E (Interface Speed) are not match criteria in a Security Policy rule; they are operational or performance metrics of the device and have no role in classifying or matching traffic flows.

Answer

Hardware Temperature

Answer

Management Plane Load

Answer

Interface Speed

Question 15

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

Accepted Answer

The dependent application, such as 'ssl', is not allowed in the policy.. If the App-ID is correct but traffic is denied, the dependent application (like ssl) might be missing.

Answer

The source zone is incorrect.

Answer

The firewall is in transparent mode.

Answer

The security profile is missing.