NetSec-Pro Practice Test 17 — 15 Questions

Question 1

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

Accepted Answer

Config Logs. Config Logs in Palo Alto Networks firewalls record configuration changes made by administrators, including who made the change, what was modified, and when. When investigating firewall configuration modifications, Config Logs are the authoritative source because they capture the commit history and administrative actions on the device.

Answer

System Logs

Answer

Threat Logs

Answer

Traffic Logs

Question 2

A security analyst is investigating a series of alerts indicating that an internal host is communicating with a known malicious IP address. The analyst wants to verify whether the traffic was allowed by a specific security policy rule and determine the exact rule name that permitted the session. Which Palo Alto Networks feature should the analyst use to identify the rule that allowed the traffic?

Accepted Answer

Traffic log. The Traffic log on Palo Alto Networks firewalls captures detailed information about every session, including the name of the security policy rule that allowed or denied it. By filtering for the malicious IP address, the analyst can pinpoint the rule responsible for permitting the traffic, which is essential for remediation and policy tuning.

Answer

System log

Answer

Threat log

Answer

Session Browser

Question 3

A network security administrator is configuring a firewall to forward traffic to a sandboxing service for analysis. The administrator wants to ensure that any file determined to be malicious by the sandbox is automatically blocked in real time on subsequent attempts. Which feature should be enabled on the firewall to achieve this?

Accepted Answer

WildFire inline cloud analysis. WildFire inline cloud analysis enables the firewall to submit files to the WildFire cloud and, upon receiving a malicious verdict, immediately block the file for subsequent download attempts. This provides real-time protection without waiting for a periodic signature update, directly satisfying the requirement.

Answer

DNS Security

Answer

File Blocking profile

Answer

URL Filtering

Question 4

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

Accepted Answer

The security policy rules do not have an attached Security Profile Group.. Threat Prevention logs are only generated when traffic matches a security policy rule that has a Security Profile Group (or individual security profiles) attached. Without an attached profile group, the firewall performs only basic policy allow/deny and never invokes the threat engines, so no Threat log entries are produced even with a valid subscription. The subscription alone does not enable inspection — it only licenses the content updates.

Answer

The 'Threats' dynamic update is not scheduled.

Answer

The firewall is in 'Evaluation Mode'.

Answer

The log forwarding profile is missing the 'Global' setting.

Question 5

Where do you navigate in PAN-OS to update the App-ID and Threat signatures to the latest versions?

Accepted Answer

Device > Dynamic Updates. In PAN-OS, App-ID and Threat signature updates are managed under Device > Dynamic Updates. This section allows you to check for and install the latest content updates, including applications, threats, and antivirus signatures.

Answer

Network > Interfaces

Answer

Objects > Applications

Answer

Policies > Security

Question 6

What is the purpose of a 'Security Profile Group'?

Accepted Answer

To combine multiple security profiles into a single object for easier policy assignment.. A Security Profile Group in Palo Alto Networks firewalls is a logical container that bundles multiple security profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and WildFire Analysis) into a single referenced object. This allows administrators to apply a consistent set of security inspections to a security policy rule with one selection, rather than attaching each profile individually. It simplifies policy management and ensures uniform enforcement across rules that require the same security posture.

Answer

To organize firewall administrators by department.

Answer

To collect all logs from a specific security zone.

Answer

To group firewall interfaces for load balancing.

Question 7

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

Accepted Answer

Upload images to Panorama and use the 'Software' tab to push them to devices.. Uploading images to the Panorama server first allows for consistent deployment to all managed firewalls.

Answer

Use the 'Auto-Update' feature on firewalls only.

Answer

Download images directly on each firewall.

Answer

Use an external TFTP server for all devices.

Question 8

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Accepted Answer

Dynamic Address Groups. Dynamic Address Groups allow tagging of IP addresses based on criteria such as the 'Server' role. These tags can then be used in security policies to group traffic dynamically. This is ideal for environments where server IPs change frequently, as the group membership updates automatically based on the tags.

Answer

Device Groups

Answer

Static Address Groups

Answer

Security Profiles

Question 9

A security team is deploying a new internal certificate authority for TLS inspection. They want to ensure that compromised private keys can be traced and that certificate issuance is cryptographically bound to a public, append-only log that monitors can audit. Which mechanism should they implement?

Accepted Answer

Certificate Transparency logs with signed certificate timestamps. Certificate Transparency is the mechanism that publishes issued certificates to append-only public logs and returns signed certificate timestamps. This gives monitors the ability to detect unauthorized issuance and provides an auditable trail. OCSP stapling, EV vetting, and pinning address revocation performance, identity assurance, and client trust respectively, but none creates the public issuance log required.

Answer

Extended Validation certificate policy with organizational vetting

Answer

Certificate pinning of the internal root within client applications

Answer

Online Certificate Status Protocol stapling on all issued certificates

Question 10

A network engineer is troubleshooting a Palo Alto Networks firewall where a decryption policy is not decrypting traffic as expected. The policy is configured to decrypt traffic to a specific web server, but the traffic passes through encrypted. Which step should be taken first to diagnose the issue?

Accepted Answer

Check the decryption policy rule order and ensure no preceding rule is matching with a no-decrypt action. Decryption policies are processed in order. A preceding no-decrypt rule can prevent a later decrypt rule from taking effect. Checking the rule order and actions is the first diagnostic step to ensure the intended decrypt rule is reached. Other factors like certificates are secondary.

Answer

Verify the forward trust certificate is installed and trusted by the client

Answer

Ensure the SSL Forward Proxy is enabled on the egress interface

Answer

Confirm that the server's certificate is signed by a trusted CA

Question 11

A network security engineer is configuring a firewall to protect against brute force attacks on the web server. The engineer wants to limit the number of concurrent connections from a single IP address to the web server to 50. Which feature should be configured?

Accepted Answer

DoS Protection profile with a concurrent connection limit.. A DoS Protection profile is designed to detect and mitigate various denial-of-service attacks, including limiting concurrent connections per source IP. By applying a DoS Protection profile to the security rule that permits traffic to the web server, the engineer can enforce the 50-connection limit, protecting the server from brute force or connection exhaustion.

Answer

Zone Protection profile with SYN flood protection.

Answer

QoS profile with a maximum connection rate.

Answer

Security policy rule with an application filter for web-browsing.

Question 12

Which of the following are valid methods for performing an initial configuration of a Palo Alto Networks NGFW? (Choose TWO)

Accepted Answer

Console port connection. Initial access is typically performed via the Console port (serial) or the Management interface (default IP).

Answer

Automatic Cloud provisioning via USB

Answer

SSH to the data plane interface

Answer

Bluetooth pairing

Question 13

An administrator is configuring a SASE solution with Prisma Access and needs to ensure that all traffic from mobile users is inspected by the NGFW security stack, including traffic to the internet and to private applications. The administrator has already configured the GlobalProtect portal and gateway. Which additional component must be configured to allow mobile users to access private applications hosted in the data center?

Accepted Answer

A service connection to the data center. To allow mobile users to access private applications hosted in a data center, a service connection must be configured in Prisma Access. The service connection creates an IPsec tunnel between Prisma Access and the data center, enabling traffic from mobile users to reach private applications. Other options like remote network connections, split tunneling, or decryption do not provide the necessary connectivity.

Answer

A GlobalProtect app configuration with split tunneling enabled

Answer

A remote network connection to the data center

Answer

A Decryption policy rule for private applications

Question 14

A network security engineer is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic for inspection. The engineer wants to avoid decrypting traffic to financial institutions and healthcare sites for privacy compliance. Which firewall feature should be used to selectively bypass decryption for these categories?

Accepted Answer

Decryption policy with a 'no-decrypt' action based on URL Category. A decryption policy with a 'no-decrypt' action based on URL Category allows the firewall to selectively bypass decryption for specific categories, such as financial services and healthcare. This satisfies privacy compliance while still decrypting other traffic for security inspection. The other options either do not bypass decryption or are unrelated to the requirement.

Answer

Application Override policy for financial and healthcare applications

Answer

SSL Forward Proxy with a custom certificate for each category

Answer

URL Filtering profile with a 'block' action for those categories

Question 15

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to enforce data loss prevention by blocking the upload of files containing credit card numbers. The engineer also wants to ensure that the application is identified correctly even if it uses non-standard ports. Which two Palo Alto Networks features should be used together to achieve these goals? (Choose two.)

Accepted Answer

Data Filtering profile with a credit card pattern. To allow a SaaS application while blocking uploads of files containing credit card numbers, the engineer must use App-ID to accurately identify the application regardless of port, and a Data Filtering profile to detect and block the sensitive data pattern. App-ID ensures the traffic is correctly classified, and the Data Filtering profile enforces the data loss prevention policy. Other options either do not inspect content or are too broad, making them incorrect for this scenario.

Answer

URL Filtering profile with a custom URL category for the SaaS application

Answer

File Blocking profile configured to block all file uploads

Answer

Threat Prevention profile to block known malicious IPs