NetSec-Pro Practice Test 18 — 15 Questions

Question 1

A security engineer is deploying a new Palo Alto Networks firewall pair in an active/passive high availability configuration. The requirement is that if the active device's link to the upstream core switch fails, the passive device must take over immediately, even if the passive device's own link to that same switch is still up. Which HA configuration satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Link Monitoring group on both peers containing the upstream interface, set the Failure Condition to 'any', and assign a matching Link Monitoring group ID on both devices.. Immediate takeover on an upstream link failure requires Link Monitoring, not preemption or HA1 tuning. The monitored interface must be defined in a Link Monitoring group on both peers with a matching group ID and Failure Condition 'any', so the active device relinquishes the active role the moment that link drops while the passive device's matching link remains healthy.

Answer

Enable HA Link Monitoring on the active device only, with Failure Condition set to 'any'.

Answer

Set the HA1 control link to use a dedicated interface and enable HA1 encryption between the peers.

Answer

Enable preemption and set the active device's priority lower than the passive device's priority.

Question 2

A security engineer is using the Palo Alto Networks Expedition tool to migrate a configuration from a Cisco ASA firewall to a Palo Alto Networks firewall. After importing the ASA configuration, the engineer notices that some access control rules are not being translated correctly. What is the most likely cause?

Accepted Answer

The ASA configuration contains unsupported object types that Expedition cannot parse.. Expedition may not fully support all ASA object types, leading to incomplete or incorrect translation of associated rules. The tool provides a report of unsupported items, which should be reviewed. The other options are less likely because Expedition is built to handle typical ASA exports and any/any rules, and PAN-OS version affects import, not translation.

Answer

The ASA configuration includes rules with any/any which Expedition cannot translate.

Answer

The ASA configuration was exported in a format that Expedition does not support.

Answer

The Palo Alto Networks firewall is running an older version of PAN-OS that is incompatible with Expedition.

Question 3

Which TWO of the following are required to successfully implement an App-ID based Security policy?

Accepted Answer

The application must be explicitly defined in the 'Application' field of the Security policy.. Security policies require an App-ID (or 'any') and the 'Application Default' service port setting to ensure the application is correctly identified and restricted to its expected ports.

Answer

The 'Log at Session Start' option must be enabled.

Answer

The rule must have a specific URL Category defined.

Answer

A 'Security Profile Group' must be attached to the rule.

Question 4

A security operations team notices that the firewall's threat logs show many 'url-filtering' entries for a business-critical SaaS application, causing help-desk tickets. The application uses multiple domains and its category changes frequently as new domains are registered. The team wants to stop the false positives without broadly allowing the SaaS category. What is the most precise approach?

Accepted Answer

Create a custom URL category containing the application's known domains and add it as an allow rule above the blocking rule in the URL Filtering profile.. A custom URL category containing the application's domains, allowed above the blocking rule, scopes the exception to exactly the traffic causing false positives. Changing the whole category to alert or excluding decryption is too broad, and IP-based permits are fragile for SaaS. This approach preserves enforcement for all other SaaS traffic.

Answer

Change the action for the SaaS category from block to alert in the URL Filtering profile.

Answer

Create a new security policy rule permitting the application's IP addresses and move it above the rule that applies URL Filtering.

Answer

Add the application's domains to the SSL Decryption Exclusion list so the traffic is not inspected.

Question 5

Which TWO methods can be used to manage administrator access to a Palo Alto Networks firewall?

Accepted Answer

Local Administrator Accounts. Local Administrator Accounts (B) are correct because the firewall stores admin credentials locally in its configuration, allowing administrators to authenticate directly against the device with a username and password (and optionally a certificate) without any external server. RADIUS Authentication (C) is correct because the firewall supports external authentication profiles, so administrator logins can be validated against a RADIUS server, enabling centralized management of admin access. GlobalProtect Portal (A) is incorrect because it provides remote user VPN/endpoint access, not firewall administrator authentication. App-ID Override (D) is incorrect because it is a policy feature for changing application identification, not an admin access method. SSL Forward Proxy (E) is incorrect because it is a decryption feature for inspecting outbound SSL traffic, unrelated to administrator access management.

Answer

GlobalProtect Portal

Answer

App-ID Override

Answer

SSL Forward Proxy

Question 6

An administrator is configuring a File Blocking profile to prevent users from downloading executable files from the internet. The administrator wants the firewall to block the download but still forward the file hash to WildFire for analysis. Which File Blocking action accomplishes this?

Accepted Answer

Block-and-Forward. Block-and-Forward is designed for exactly this dual requirement: it denies the file transfer so the executable never reaches the endpoint, while forwarding the sample or hash to WildFire for cloud analysis. Plain Block would stop the download but lose the analysis signal, and Alert or Continue would not block at all.

Answer

Alert

Answer

Continue

Answer

Block

Question 7

You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?

Accepted Answer

Define a specific Address Object for the destination server and bind it to the correct zone.. The principle of least privilege requires that a Security Policy rule permit only the specific traffic needed. Defining a specific Address Object for the destination server and binding it to the correct destination zone ensures the rule matches only that server, not an entire subnet or any address. This is the correct approach for a least-privilege policy. Using 'any' for zone or address, or relying on the intrazone-default rule, violates least privilege by allowing broader traffic than necessary.

Answer

Use the 'intrazone-default' policy to automatically allow traffic to all servers.

Answer

Set destination zone to 'any' and destination address to 'any' to ensure traffic flow.

Answer

Configure the security policy to reference the interface IP rather than an Address Object.

Question 8

A multinational company uses Prisma Access to secure remote workers. They want to ensure that employees can access only approved SaaS applications and that any attempt to use unsanctioned SaaS is blocked and logged for compliance. They also need to apply different policies based on the user's department. Which Prisma Access feature should they use to enforce application-level access control with department-based granularity?

Accepted Answer

Security policy rules with App-ID and user group-based scoping. The requirement is to allow only approved SaaS, block unsanctioned SaaS with logging, and apply different policies by department. Security policy rules with App-ID and user group-based scoping achieve this by identifying applications and scoping rules to groups that map to departments. This provides application-level control and granular enforcement. Split tunneling, URL Filtering, and HIP profiles do not offer the same combination of application identification and department-based policy differentiation.

Answer

GlobalProtect app configuration with split tunneling

Answer

HIP profiles with department-specific host posture checks

Answer

URL Filtering profile with custom URL categories for each department

Question 9

Which TWO of the following are features of Content-ID?

Accepted Answer

Vulnerability Protection. Content-ID is Palo Alto Networks' integrated threat-prevention engine, and its features include Vulnerability Protection (A), which uses signatures to detect and block exploits targeting software vulnerabilities, and Data Filtering (B), which inspects traffic for sensitive data patterns such as credit card or Social Security numbers and can block or alert on them. Both A and B are delivered as Content-ID security profiles applied to security policy rules. User-ID mapping (C) is a separate technology that maps IP addresses to users via agents and directory services, not a Content-ID feature. App-ID identification (D) is the core engine that classifies applications regardless of port or protocol, and Zone protection (E) is a network-level profile applied to zones for flood and reconnaissance defense; neither is part of Content-ID.

Answer

User-ID mapping

Answer

App-ID identification

Answer

Zone protection

Question 10

When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?

Accepted Answer

It remains on the Panorama appliance and must be archived manually.. Migrating from Panorama to Strata Cloud Manager (SCM) migrates configuration objects and policies, but it does not migrate the log data stored on the Panorama appliance. Logs remain on Panorama's local storage (or its external log collectors) and must be archived or exported manually if retention is required. SCM does not ingest or take ownership of existing Panorama log records.

Answer

It is automatically moved to SCM storage.

Answer

It is purged immediately upon successful migration.

Answer

It is exported as a CSV file to the administrator's desktop.

Question 11

A security engineer is using the firewall's REST API to retrieve the current list of all security rules in the 'vsys1' virtual system. The engineer wants to receive the response in JSON format. Which API request should be used?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security&output=json. To retrieve the security rulebase configuration for vsys1 in JSON format, the engineer must use the config API with action=get and the correct xpath targeting the security rules. The output=json parameter ensures the response is in JSON. Operational commands and set actions do not retrieve configuration data, and show is not a valid config action.

Answer

GET /api/?type=config&action=show&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security&output=json

Answer

POST /api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security&output=json

Answer

GET /api/?type=op&cmd=

&output=json

Question 12

A security administrator is troubleshooting why a Security policy rule that allows access to a specific SaaS application is not working for some users. The rule uses App-ID and User-ID, and the users are authenticated via GlobalProtect. The administrator notices that the rule matches for some users but not others, even though they are in the same User-ID group. What is the most likely cause?

Accepted Answer

The users who are not matching have not been mapped to the correct User-ID group due to a delay in group membership synchronization.. The most likely cause is a delay in User-ID group membership synchronization. User-ID relies on timely updates from directory services; if synchronization is delayed, some users may not be recognized as members of the required group, causing the rule to not match. The other options are less likely because they would affect all users or are not indicated in the scenario.

Answer

The Security policy rule is not configured to use the correct application dependency.

Answer

The non-matching users are connecting from a different geographic location, and the rule is restricted by source region.

Answer

The GlobalProtect app version on the non-matching users' devices is outdated and does not support User-ID.

Question 13

Which THREE criteria can be used to define a security policy for granular control?

Accepted Answer

App-ID.. App-ID (B) is correct because it lets the policy match traffic by the actual application regardless of port or protocol, enabling granular application-level control. User-ID (C) is correct because matching on user or group identity ties rules to who is generating the traffic, not just to IP addresses. Source and Destination Zones (E) are correct because zone-based matching defines where traffic enters and exits the firewall, which is a fundamental granular policy criterion. BGP peer status (A) and interface physical status (D) are not policy match criteria; they are routing and link-state conditions that do not define which traffic a security rule permits or denies.

Answer

BGP peer status.

Answer

Interface physical status.

Question 14

Which THREE of the following are consequences of enabling 'Log at Session End'?

Accepted Answer

Provides accurate session duration.. Option A is correct because 'Log at Session End' writes the session's start and end timestamps to the traffic log only when the session closes, yielding an accurate session duration rather than an estimate from an interim log. Option C is correct because the end-of-session log captures the final cumulative bytes sent and received (bytes_client and bytes_server) for the entire session, giving accurate byte counts. Option E is correct because the session-end log includes the full App-ID result, including comprehensive application details such as the identified application, category, subcategory, and risk, which may not be fully resolved in a session-start log. Option B is wrong because 'Log at Session End' is purely a logging behavior and does not force session termination. Option D is wrong because this setting only writes a log entry at session close; it does not generate an immediate notification to the administrator.

Answer

Forces the session to terminate.

Answer

Immediately notifies the administrator.

Question 15

An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?

Accepted Answer

The Security Policy is missing an attached Security Profile Group.. App-ID correctly identifying traffic only proves that the firewall's identification engine is working; it does not mean any action will be taken. In Palo Alto Networks PAN-OS, a Security Policy rule must have a Security Profile Group (or individual profiles) attached to enforce antivirus, anti-spyware, vulnerability protection, URL filtering, or file blocking. Without an attached profile group, the rule simply allows or denies traffic based on App-ID and user/zone matching, but no content inspection is applied.

Answer

The Zone protection profile is misconfigured.

Answer

App-ID is disabled globally.

Answer

Decryption is not enabled.