NetSec-Pro Practice Test 16 — 15 Questions

Question 1

Which THREE of the following are considered 'App-ID' identification techniques?

Accepted Answer

Signature-based identification. In Palo Alto Networks App-ID, signature-based identification (A) is correct because the firewall matches application-specific byte patterns and protocol signatures in the payload to recognize known applications. Protocol decoding (B) is correct because App-ID decodes and validates the application's protocol structure and stateful exchanges to confirm the actual application rather than just the port. Heuristic/Behavioral analysis (D) is correct because App-ID uses behavioral heuristics to identify applications that evade strict signatures, such as unknown or custom applications, by analyzing traffic patterns and characteristics. Source IP inspection (C) is not an App-ID technique; it is a network-layer attribute used in policy matching but does not identify the application itself. MAC address filtering (E) is a Layer 2 access control mechanism and has no role in application identification.

Answer

Source IP inspection

Answer

MAC address filtering

Question 2

Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?

Accepted Answer

Ensure the App-ID override policy is correctly configured for the traffic.. Option B is correct because an App-ID override policy forces traffic to be classified as a specific application, so if it is misconfigured or missing, the firewall will not identify the traffic as the intended application. Option D is correct because many applications use TLS/SSL, and without SSL decryption the firewall cannot inspect the encrypted payload and may only identify the traffic as ssl or web-browsing instead of the actual application. Option E is correct because App-ID relies on application signatures and behavior, and applications running on non-standard ports can be misidentified or fall back to a generic port-based or unknown-tcp/unknown-udp classification. Option A is not relevant because the MAC address table is a Layer 2 forwarding table and does not determine application identification. Option C is not relevant because system clock synchronization affects certificates, logs, and authentication, but not the App-ID signature matching process itself.

Answer

Verify the MAC address table.

Answer

Check the system clock synchronization.

Question 3

Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?

Accepted Answer

Dynamic Updates.. Dynamic Updates (D) are correct because firewall vendors such as Palo Alto Networks deliver signature, application, and threat databases through scheduled dynamic update subscriptions, ensuring the device automatically receives the newest threat intelligence without manual intervention. External Dynamic Lists (E) are correct because they let the firewall import continuously refreshed lists of malicious IPs, URLs, or domains from an external server (e.g., via HTTP/HTTPS), so threat intelligence stays current as the source list changes. VLAN tagging (A) is only a Layer 2 mechanism for segmenting traffic and carries no threat data. Manual IP entry (B) is static and quickly becomes outdated, so it cannot keep intelligence current. DHCP reservation (C) merely assigns a fixed IP address to a host and has no relation to threat intelligence feeds.

Answer

VLAN tagging.

Answer

Manual IP entry.

Answer

DHCP reservation.

Question 4

Which object type is used to group multiple IP addresses or subnets for use in a security policy?

Accepted Answer

Address Group. Address Objects can be grouped into an Address Group to simplify policy management.

Answer

Policy Group

Answer

Application Group

Answer

Service Group

Question 5

Which THREE items are necessary for a properly configured Security Policy rule?

Accepted Answer

Application. A Security Policy rule in Palo Alto Networks PAN-OS requires three mandatory match criteria to identify the traffic: Application (A), Source Zone (B), and Destination Zone (E). The Application field specifies which application or application group the rule matches (e.g., ssl, web-browsing), and it is required because PAN-OS uses App-ID to enforce policy. The Source Zone (B) defines the ingress zone from which traffic originates, and the Destination Zone (E) defines the egress zone to which traffic is destined; both are required because zone-based policy is fundamental to how PAN-OS evaluates sessions. Admin Role (C) is incorrect because it is an administrative RBAC construct for controlling who can manage the firewall, not a field in a Security Policy rule. Panorama Template (D) is incorrect because templates are used to push device and network configuration via Panorama, not to define Security Policy rule match conditions.

Answer

Admin Role

Answer

Panorama Template

Question 6

Which TWO settings are configurable within a URL Filtering profile?

Accepted Answer

Custom URL list (allow/block). Option B (Custom URL list (allow/block)) is correct because a URL Filtering profile lets you define custom URL categories/lists and set allow, block, alert, or continue actions for specific URLs or domains. Option D (Category-based blocking) is correct because URL Filtering profiles are built around predefined URL categories (e.g., social-networking, gambling) where you assign block/allow/alert actions per category. Option A is incorrect because application signature overrides belong to Application Override policy or App-ID configuration, not URL Filtering profiles. Option C is incorrect because SSL Decryption is configured in a Decryption policy/profile, not inside a URL Filtering profile. Option E is incorrect because User-ID mapping source is configured under User Identification (e.g., User-ID agents, terminal server agents, or XML API), not in a URL Filtering profile.

Answer

Application signature override

Answer

SSL Decryption mode

Answer

User-ID mapping source

Question 7

A company wants to prevent users from resolving domain names for known malicious command-and-control servers. The security team already subscribes to a threat intelligence feed that publishes malicious domains. Which control should be implemented to block DNS resolutions for those domains at the network level?

Accepted Answer

DNS sinkholing that returns a non-routable address for malicious domains. DNS sinkholing consults a threat intelligence list and returns a non-routable or controlled address for malicious domains, preventing clients from reaching command-and-control infrastructure. DNSSEC, DoH, and Response Rate Limiting address integrity, privacy, or volumetric abuse respectively, but none of them block resolution based on a malicious domain feed.

Answer

Response Rate Limiting on the authoritative DNS servers

Answer

DNS over HTTPS to encrypt all client DNS queries

Answer

DNSSEC validation on the internal recursive resolver

Question 8

An engineer is configuring a SASE solution to provide secure web access for remote users. The organization wants to enforce different security policies based on user group membership. Which component of the SASE solution is responsible for applying security policies to web traffic?

Accepted Answer

Prisma Access. In a SASE architecture, Prisma Access provides the security processing nodes that enforce web security policies, including user- and group-based rules. GlobalProtect provides connectivity, while DNS Security and WildFire are specialized threat prevention services. The enforcement of web policies for remote users occurs in Prisma Access.

Answer

WildFire

Answer

DNS Security

Answer

GlobalProtect

Question 9

A security engineer is deploying a SASE solution to protect remote users accessing SaaS applications. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to sanctioned SaaS applications is controlled based on user identity. Which SASE component should the engineer configure to achieve these goals?

Accepted Answer

Prisma Access. Prisma Access is the SASE solution that integrates multiple security services, including threat inspection and secure access to SaaS applications. It enforces policies based on user identity and application, making it the appropriate component to configure for the described goals. GlobalProtect, DNS Security, and WildFire are supporting components but do not independently provide the required comprehensive capabilities.

Answer

GlobalProtect

Answer

WildFire

Answer

DNS Security

Question 10

Which THREE components are required to successfully deploy and use Advanced URL Filtering?

Accepted Answer

An active Advanced URL Filtering subscription.. Option B is correct because Advanced URL Filtering is a licensed cloud-delivered service, so an active Advanced URL Filtering subscription must be present on the firewall to enable the advanced categories, inline ML-based classification, and cloud lookups. Option E is correct because the firewall must have a URL Filtering profile that defines the desired actions (allow, block, alert, continue, override) for URL categories before any traffic can be filtered. Option C is correct because the profile only takes effect when it is attached to a Security Policy rule that matches the traffic, so an enabled rule referencing the URL Filtering profile is required for enforcement. Option A is not required because Advanced URL Filtering runs on the Palo Alto Networks firewall itself and does not need an endpoint agent on user devices. Option D is not required because URL database and cloud updates are delivered through the existing management/dataplane infrastructure, not a dedicated management interface.

Answer

An endpoint agent installed on all user devices.

Answer

A dedicated management interface for URL updates.

Question 11

An administrator is troubleshooting a NetSec-Pro firewall where dynamic updates for App-ID and Threat signatures are failing. The firewall has valid internet access, and the management interface has a default route. Which action should be taken next to resolve the issue?

Accepted Answer

Verify that the firewall can resolve the update server's DNS name.. Dynamic update failures often stem from DNS resolution issues, even when general internet access works. The firewall must resolve the update server's hostname to connect. Verifying DNS resolution is a targeted troubleshooting step that can quickly identify the problem. Other actions like checking licenses or rebooting are less specific to the symptom.

Answer

Increase the management interface's MTU to 9000.

Answer

Reboot the firewall to clear any temporary glitches.

Answer

Check the license status to ensure the support contract is active.

Question 12

A network security engineer is configuring a Palo Alto Networks firewall to protect against a specific threat: a malicious PDF file being downloaded from a web server. The engineer wants to block the download and log the event. Which security profile should be configured to detect and block the malicious PDF?

Accepted Answer

Antivirus profile. To detect and block a malicious PDF, the Antivirus profile is the correct choice because it scans files for malware using signatures. The profile can be configured to block the file and log the event. Other profiles like Anti-Spyware, Vulnerability Protection, or File Blocking do not perform file content scanning for malware, so they would not reliably block a malicious PDF.

Answer

Anti-Spyware profile

Answer

File Blocking profile

Answer

Vulnerability Protection profile

Question 13

An administrator is using Strata Cloud Manager to manage a large number of firewalls. They need to generate a report that shows which security policy rules are unused across all managed firewalls over the past 90 days. The report should help identify rules that can be safely removed to improve performance. Which Strata Cloud Manager feature should be used?

Accepted Answer

Policy Optimizer. Policy Optimizer is designed to analyze security policy usage across managed firewalls and identify rules that have not been hit over a specified period. It provides reports and recommendations for removing or modifying unused rules, which helps improve firewall performance and reduce complexity. Other features like Policy Preview or Traffic Logs do not offer this aggregated, historical analysis of rule usage.

Answer

Policy Preview

Answer

Traffic Logs

Answer

Security Profiler

Question 14

A security architect is hardening a PAN-OS firewall that protects a data center. The architect wants to reduce the attack surface exposed by the firewall's own management and control functions. Which TWO measures directly harden the management plane? (Choose two.)

Accepted Answer

Enforce multi-factor authentication for administrator logins to the web interface and CLI. Hardening the management plane means limiting who can reach it and strengthening how they prove identity. Restricting permitted source addresses and services on the management interface reduces exposure, while enforcing multi-factor authentication protects against stolen credentials. Both target the firewall's administrative access directly, unlike dataplane controls.

Answer

Enable a zone protection profile on the Untrust zone to block reconnaissance scans

Answer

Configure Quality of Service to prioritize management traffic over user data

Answer

Apply a URL filtering profile to the outbound security rule used by internal users

Question 15

Which command is used to restart the management server process on the firewall without impacting traffic flow?

Accepted Answer

debug software restart process management-server. The command `debug software restart process management-server` is specifically designed to restart the management server process on a Palo Alto Networks firewall. This operation only affects the management plane, not the data plane, so traffic flow continues uninterrupted. It is the correct way to recover the management interface or web UI without causing an outage.

Answer

request system reboot

Answer

clear session all

Answer

exit