NetSec-Pro Practice Test 19 — 15 Questions

Question 1

You need to allow traffic based on user group membership. Which feature must be configured to map users to their group information?

Accepted Answer

User-ID. User-ID is the PAN-OS feature that maps IP addresses to users and groups by integrating with directory services like Active Directory, LDAP, or RADIUS. It collects user-to-IP mapping information and makes it available to Security policy rules, allowing policies to be written based on user or group membership rather than just IP addresses.

Answer

App-ID

Answer

Device-ID

Answer

Content-ID

Question 2

A NetSec-Pro administrator needs to ensure that the firewall can receive dynamic updates for applications and threats. The administrator has verified that the management interface has internet access. Which service must be configured on the management interface to allow these updates?

Accepted Answer

Update Server. The Update Server configuration on the management interface defines the source for dynamic updates. Even with internet access, the firewall needs to know where to download updates from. By default, it uses the Palo Alto Networks update server, but this can be changed to an internal server. Ensuring this setting is correct is essential for the firewall to receive the latest signatures and protect against emerging threats.

Answer

SMTP

Answer

NTP

Answer

DNS

Question 3

A security team is deploying a new internal application that uses a proprietary protocol over TCP port 8443. The team wants the firewall to inspect the application and enforce policy based on the application rather than just the port. Which Palo Alto Networks feature should be used to identify and control this application?

Accepted Answer

Application Override policy. Application Override policies let administrators define custom applications by specifying the port and protocol, enabling the firewall to identify and apply security policies to traffic that standard App-ID cannot recognize. This is the correct approach for a proprietary protocol on TCP port 8443, whereas URL, Data, and File Blocking profiles address different security functions.

Answer

Data Filtering profile

Answer

File Blocking profile

Answer

URL Filtering profile

Question 4

A security analyst is reviewing logs and notices that a user's traffic to a known malicious domain is being allowed. The analyst checks the URL Filtering profile and sees that the domain is categorized as 'malware' and the action is set to 'alert'. The analyst wants to block this traffic immediately. What should the analyst change in the URL Filtering profile?

Accepted Answer

Change the action for the malware category to 'block'. The URL Filtering profile has a specific action for each URL category. Since the malicious domain is categorized as malware, the appropriate action is to change the malware category action from 'alert' to 'block'. This will enforce blocking for all domains in that category, including the one in question. The other options either do not directly address the issue or are less efficient.

Answer

Enable 'safe search' enforcement in the URL Filtering profile

Answer

Add the domain to a custom URL category with a 'block' action

Answer

Set the action for the 'unknown' category to 'block'

Question 5

A security administrator is deploying Prisma Access for mobile users and needs to ensure that traffic from remote users is inspected for threats and sensitive data. The administrator wants to leverage the Prisma Access architecture to apply security policies consistently. Which TWO of the following components are essential for enforcing security policies on mobile user traffic in Prisma Access? (Choose two.)

Accepted Answer

GlobalProtect app on the endpoint. To enforce security policies on mobile user traffic in Prisma Access, the GlobalProtect app on the endpoint is required to establish the secure connection and redirect traffic. The security processing nodes are the enforcement points where policies are applied. Together, they ensure that mobile user traffic is inspected and controlled according to the organization's security policies. Other components like Cloud Identity Engine, explicit proxy, and service connection serve different roles and are not essential for the enforcement itself.

Answer

Service connection

Answer

Explicit proxy

Answer

Cloud Identity Engine

Question 6

A network security engineer needs to verify that a newly created security policy in Strata Cloud Manager will not block critical business applications. The engineer wants to simulate the policy against recent traffic logs without enforcing it. Which Strata Cloud Manager feature should be used?

Accepted Answer

Policy Preview. Policy Preview is a Strata Cloud Manager capability that lets administrators test a security policy rule against historical traffic logs to see what would be allowed or denied. It provides a safe way to validate policy changes before enforcement, ensuring that critical applications are not inadvertently blocked. Other features like Policy Optimizer or Traffic Logs serve different purposes and cannot simulate a new policy's impact.

Answer

Policy Optimizer

Answer

Traffic Logs

Answer

Security Profiler

Question 7

A security administrator is troubleshooting why a web server in the DMZ zone cannot be reached by external clients even though the inbound security policy permits the traffic. The administrator confirms that the DMZ interface has an IP address, the external interface has an IP address, and static routes exist in both directions. The web server's default gateway points to the firewall's DMZ interface. Which additional configuration is required for the firewall to translate the public destination address to the web server's private address?

Accepted Answer

A destination NAT policy that maps the external address and port to the web server's private address and port. Inbound access to a privately addressed server requires destination NAT so the firewall rewrites the public destination address and port to the server's private values. Security policy permits the session, and routing delivers it to the firewall, but without the translation the server receives a packet addressed to an address it does not own and silently discards it.

Answer

A dynamic routing protocol adjacency between the external router and the firewall

Answer

A policy-based forwarding rule that redirects inbound traffic to the DMZ interface

Answer

A source NAT policy that translates the web server's outbound traffic to the external interface address

Question 8

If a packet matches a Security Policy rule, but the application is not explicitly defined in the rule, what happens to the traffic?

Accepted Answer

The packet is matched based on the defined service (port).. When a Security Policy rule is configured with a service (port) but without an explicit application, the firewall matches traffic based on the Layer 4 service definition. This means any application using that port will be permitted or denied according to the rule's action, without application-layer inspection. The firewall does not attempt to identify the application or enforce application-specific controls in this case.

Answer

The packet is automatically dropped.

Answer

The traffic is bypassed.

Answer

The firewall prompts for manual identification.

Question 9

A security administrator is deploying a new Palo Alto Networks next-generation firewall in a remote branch office. The branch has limited on-site IT staff and no dedicated management server. The administrator wants to centrally manage this firewall, push security policies, and monitor traffic without deploying Panorama. Which Palo Alto Networks cloud-delivered service should be used?

Accepted Answer

Strata Cloud Manager. Strata Cloud Manager is the cloud-delivered management solution from Palo Alto Networks that provides centralized management, policy enforcement, and visibility for firewalls and other security services. It is specifically designed for organizations that want to avoid deploying on-premises management infrastructure like Panorama, making it the correct choice for managing a remote branch firewall with minimal on-site resources.

Answer

AutoFocus

Answer

WildFire

Answer

Panorama

Question 10

A security administrator is deploying Prisma Access for a branch office. The branch office needs to access internal applications hosted in the corporate data center. Which Prisma Access component should be configured to enable this connectivity?

Accepted Answer

Service connection. To enable a branch office to access internal applications in the corporate data center through Prisma Access, a service connection must be configured. The service connection establishes a secure tunnel between Prisma Access and the corporate network, allowing traffic from the branch to reach internal resources. Remote network connections secure branch traffic to the internet, mobile user connections are for individual remote users, and explicit proxy is for web traffic redirection. Thus, service connection is the correct component.

Answer

Mobile user connection

Answer

Explicit proxy

Answer

Remote network connection

Question 11

A NetSec-Pro administrator is configuring a new security policy to allow internal users to access a web server in a DMZ. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and that all other traffic is blocked. Which NetSec-Pro feature should be used to identify and control the application?

Accepted Answer

App-ID. App-ID enables the firewall to identify applications accurately, even when they use non-standard ports or encryption. By using App-ID in the security policy, the administrator can allow only HTTP and HTTPS applications and block all others, ensuring precise control based on the actual application rather than just ports or services.

Answer

Application Override policy

Answer

URL Filtering profile

Answer

Service objects

Question 12

A network architect must choose an encryption mode for securing site-to-site traffic over an untrusted provider network. The requirement is to provide confidentiality and integrity for each packet independently, allow parallel processing, and avoid the need for sequential block chaining. Which mode should be selected?

Accepted Answer

Galois/Counter Mode with a unique nonce per packet. GCM is an authenticated encryption mode that provides confidentiality and integrity in a single pass, supports parallel processing through its counter-based structure, and uses a unique nonce per packet to avoid keystream reuse. CBC serializes blocks, ECB leaks patterns and lacks integrity, and OFB lacks authentication, so GCM is the correct choice.

Answer

Electronic Codebook mode with a fixed key

Answer

Cipher Block Chaining mode with a random initialization vector

Answer

Output Feedback mode with a 64-bit block cipher

Question 13

When adding a new Security Policy rule, what is the default position for the rule if you do not specify 'Top' or 'Bottom'?

Accepted Answer

Bottom. When you create a new Security Policy rule in the Palo Alto Networks web interface without explicitly choosing a position, the rule is appended to the bottom of the rulebase. This is the default behavior because the rulebase is evaluated top-down, and placing new rules at the bottom ensures they do not inadvertently override existing, more specific rules. Administrators must consciously move a rule to the top or a specific position if it needs higher precedence.

Answer

Immediately below the selected rule.

Answer

Middle

Answer

Top

Question 14

A NetSec-Pro administrator is configuring a security policy to allow inbound access to a web server in the DMZ. The administrator wants to ensure that the policy is as restrictive as possible. Which combination of settings should be used?

Accepted Answer

Source zone: Untrust, Destination zone: DMZ, Application: web-browsing, Service: application-default. The most restrictive policy specifies the exact source and destination zones, the specific application (web-browsing), and uses application-default for the service. This ensures that only the intended application is allowed and only on its default ports, minimizing the attack surface and adhering to least privilege.

Answer

Source zone: Untrust, Destination zone: DMZ, Application: web-browsing, Service: any

Answer

Source zone: Untrust, Destination zone: DMZ, Application: any, Service: any

Answer

Source zone: Untrust, Destination zone: DMZ, Application: any, Service: application-default

Question 15

An administrator notices that a firewall is not blocking traffic that matches a security profile group configured with anti-spyware and vulnerability protection. The traffic log shows the session is allowed, but no threat logs are generated. What is the most likely cause?

Accepted Answer

The security profile group is not attached to the security policy rule that allows the traffic.. The firewall will only enforce security profiles if they are attached to the security policy rule that permits the traffic. Even if profiles are configured globally, they must be referenced in the rule's 'Actions' tab. Without attachment, the firewall performs no threat inspection, resulting in allowed traffic without threat logs. Other options either contradict the observed log behavior or are less likely given the scenario.

Answer

The traffic is SSL encrypted and cannot be inspected without decryption.

Answer

The firewall is in tap mode and cannot block traffic.

Answer

The security profiles are configured with 'alert' instead of 'block' actions.