NetSec-Pro Practice Test 15 — 15 Questions

Question 1

Which TWO of the following are valid components of a PAN-OS Security Policy?

Accepted Answer

Source Zone. In PAN-OS, a Security Policy rule is defined by matching criteria that include the Source Zone (option A) and Destination Zone (option B), which specify the ingress and egress zones between which traffic flows and are fundamental to how the firewall evaluates and applies policy. These two fields are part of the standard rule definition alongside source/destination addresses, applications, users, and services, and they determine the direction and enforcement context of the rule. Options C (Fan speed), D (Management IP), and E (System BIOS version) are not Security Policy match or action components; fan speed and BIOS version are hardware/firmware attributes, and the management IP is a device interface configuration, none of which appear in a PAN-OS Security Policy rule.

Answer

Fan speed

Answer

Management IP

Answer

System BIOS version

Question 2

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

Accepted Answer

Add the site to the 'Allow List' in the URL Filtering profile object assigned to the security policy.. The URL Filtering profile supports an Allow List that overrides category-based blocking for specific URLs or domains. Adding the site to the Allow List in the profile attached to the relevant security policy permits that specific site while the 'Newly Registered Domains' category continues to block all other newly registered domains, preserving the intended security posture.

Answer

Move the security policy to the top of the policy list.

Answer

Add the site to the 'Blocked' list in the URL Filtering profile.

Answer

Create a new URL category and add the domain to it, then block that category.

Question 3

Which feature allows you to block traffic based on a specific geographic region?

Accepted Answer

Policy-based filtering using 'Region' objects.. Palo Alto Networks firewalls support region-based filtering through Region objects, which are predefined or custom objects representing geographic locations based on IP address geolocation databases. Security policies can reference these Region objects to allow or block traffic from specific countries or regions, providing a straightforward way to enforce geographic access controls.

Answer

User-ID

Answer

DNS Security profile.

Answer

App-ID

Question 4

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

Accepted Answer

System logs. BGP peering state changes (Idle, Connect, Active, OpenSent, OpenConfirm, Established) and neighbor messages such as OPEN, KEEPALIVE, NOTIFICATION, and UPDATE are logged in the System logs on Palo Alto Networks firewalls. Reviewing System logs is the correct way to diagnose why a BGP session is flapping or failing to establish.

Answer

Traffic logs

Answer

Threat logs

Answer

Config logs

Question 5

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Accepted Answer

To query domain controllers for IP-to-User mapping.. The User-ID Agent is a component that queries Active Directory domain controllers to map IP addresses to usernames. It reads security event logs and other sources to determine which user is logged in at which IP, then sends this mapping to the firewall. This enables User-ID-based security policies without requiring the firewall to directly query AD.

Answer

To cache user credentials for SSO.

Answer

To encrypt traffic for GlobalProtect.

Answer

To push security policies to clients.

Question 6

Which action in a Security Policy rule will cause the firewall to send a TCP Reset to the client and server?

Accepted Answer

Reset-Both. The 'Reset-Both' action terminates the connection by sending a TCP Reset packet to both endpoints.

Answer

Drop

Answer

Allow

Answer

Deny

Question 7

Which TWO of the following are benefits of using App-ID over port-based security policies?

Accepted Answer

Prevents applications from bypassing security by using non-standard ports.. Option C is correct because App-ID identifies applications by their traffic signatures and behavior rather than by TCP/UDP port, so an application attempting to evade policy by running on a non-standard port (e.g., SSH on port 8080) is still recognized and controlled. Option E is correct because once SSL decryption is configured, App-ID can inspect the decrypted payload and identify applications inside TLS sessions, giving visibility that port-based rules cannot provide. Option A is incorrect because App-ID depends on a continually updated application signature database (content updates from Palo Alto Networks) to recognize new and modified applications. Option B is incorrect because App-ID classifies traffic but does not automatically author security policies; policy creation remains an administrative task. Option D is incorrect because App-ID inspection is a security feature and does not inherently increase firewall throughput; it can in fact add processing overhead.

Answer

Requires no updates to the signature database.

Answer

Automatically creates security policies.

Answer

Increases throughput of the firewall.

Question 8

Which TWO factors contribute to 'Configuration Drift' between a firewall and Panorama?

Accepted Answer

Local administrators making changes directly on the firewall CLI.. Configuration drift occurs when the firewall's running configuration diverges from what Panorama expects to manage. Option A is correct because local administrators editing the firewall directly via the CLI create out-of-band changes that Panorama does not know about, so the device state no longer matches the Panorama-managed configuration. Option D is correct because if a template variable or parameter lacks the proper 'Override' setting, the firewall cannot accept or retain the intended value from Panorama, causing the device to keep a different value than Panorama defines. Option B is incorrect because 'Read-Only' mode prevents changes rather than causing divergence. Option C is incorrect because Panorama being offline during a push simply means the push fails or is deferred; it does not itself create drift. Option E is incorrect because differing Pan-OS versions may cause compatibility issues, but version mismatch alone is not a defined cause of configuration drift.

Answer

The firewall is in 'Read-Only' mode.

Answer

Panorama is offline during a policy push.

Answer

Using different versions of Pan-OS on Panorama and the firewall.

Question 9

When configuring a virtual wire (VWire) interface, which setting is required to pass traffic between the two physical ports?

Accepted Answer

Create a Virtual Wire object linking two interfaces.. A VWire object must be created to link two physical interfaces together; without it, they are just isolated ports.

Answer

Enable 'DHCP Server' on the interface.

Answer

Assign an IP address to the VWire sub-interface.

Answer

Configure a zone with a 'Layer 3' type.

Question 10

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

Accepted Answer

The order of the templates within the Template Stack.. In Panorama, when a setting is defined in a Template, the value that reaches the firewall is determined by the Template Stack order — the template listed highest in the stack takes precedence, and lower templates' conflicting values are overridden. If the firewall shows a different value than expected, the most likely cause is that another template higher in the stack is overriding the setting. Checking the order of templates within the Template Stack is therefore the correct first step.

Answer

The local device group lockdown setting.

Answer

The Panorama log collector status.

Answer

The firewall's OS version compatibility.

Question 11

Which plane on a Palo Alto Networks firewall is responsible for the web interface and CLI?

Accepted Answer

Management Plane. The Management Plane on a Palo Alto Networks firewall is responsible for the web interface (GUI), CLI, configuration management, logging, and administrative functions. It is separate from the data plane, which handles actual traffic forwarding and security processing. The management plane runs on the management interface and controls the device's configuration and monitoring.

Answer

Forwarding Plane

Answer

Security Plane

Answer

Data Plane

Question 12

You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?

Accepted Answer

Device > Setup > Operations. Device > Setup > Operations allows you to configure 'Scheduled Configuration Export'.

Answer

Network > GlobalProtect

Answer

Objects > External Dynamic Lists

Answer

Device > Software

Question 13

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

Accepted Answer

Assign the tunnel interface to a security zone.. Option A is correct because a Palo Alto Networks tunnel interface must be assigned to a security zone before zone-based security policy can permit or inspect traffic traversing the Site-to-Site VPN. Option B is correct because the IKE Crypto Profile (Phase 1) must match the third-party vendor's encryption, hash, DH group, and lifetime values for the IKE SA to negotiate successfully. Option C is incorrect because disabling logging is not required and would hinder troubleshooting. Option D is incorrect because a tunnel interface is a virtual point-to-point interface and does not use DHCP. Option E is incorrect because a Site-to-Site VPN is routed (Layer 3) over a tunnel interface, not an L2 bridge.

Answer

Disable all logging on the tunnel interface.

Answer

Enable DHCP on the tunnel interface.

Answer

Configure the tunnel as an L2 bridge.

Question 14

Which three types of logs can be generated by a PAN-OS firewall? (Choose THREE)

Accepted Answer

Threat logs. PAN-OS firewalls generate Threat logs (A), which record security events such as intrusion, spyware, virus, and URL filtering hits detected by the security profiles. Traffic logs (B) are also generated, capturing the start and end of sessions with details like source/destination, application, and action (allow/deny). System logs (E) are produced as well, documenting system-level events such as configuration changes, user logins, and hardware/software status. Application logs (C) are not a distinct PAN-OS log type; application information is embedded within Traffic logs. Interface logs (D) are likewise not a separate PAN-OS log category; interface-related events appear in System logs.

Answer

Application logs

Answer

Interface logs

Question 15

Which three actions can be taken when a match occurs in a Security Policy rule? (Choose THREE)

Accepted Answer

Allow. In a Palo Alto Networks Security Policy rule, the Action field defines what happens when traffic matches the rule, and the valid actions include Allow, Deny, and Reset-Both. Option A (Allow) is correct because it permits the matching traffic to pass through the firewall for further inspection or forwarding. Option D (Deny) is correct because it silently drops the matching traffic without notifying the source. Option B (Reset-Both) is correct because it drops the session and sends a TCP RST to both the client and the server, immediately terminating the connection. Option C (Monitor) is not a Security Policy action; monitoring is achieved via a separate action profile or by using the rule's logging options, not as a standalone match action. Option E (Redirect) is not a valid Security Policy action either; redirection is typically handled through other mechanisms such as policy-based forwarding or decryption, not as a match action in the rulebase.

Answer

Monitor

Answer

Redirect