NetSec-Pro Practice Test 2 — 10 Questions

Question 1

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The custom application lacks a defined signature to identify the application flow.. When using custom applications, if the traffic does not match the signature or the default port is not defined correctly, the firewall marks it as incomplete.

Answer

The security policy has not been committed to the Data Plane.

Answer

Content-ID is disabled on the Security Policy rule.

Answer

User-ID is not enabled on the ingress interface.

Question 2

What is the purpose of a 'Security Profile Group'?

Accepted Answer

To combine multiple security profiles into a single object for easier policy assignment.. A Security Profile Group is a container that holds multiple types of security profiles (AV, URL, Threat, etc.) to be applied as a single unit.

Answer

To organize firewall administrators by department.

Answer

To collect all logs from a specific security zone.

Answer

To group firewall interfaces for load balancing.

Question 3

Which THREE of the following are valid Security Profile types?

Accepted Answer

URL Filtering. Anti-spyware, Vulnerability Protection, and URL Filtering are valid profiles.

Answer

Zone Routing

Answer

Policy Optimizer

Question 4

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

Accepted Answer

Captive Portal. Captive portal provides explicit authentication for users accessing specific web resources, ensuring positive identification.

Answer

IP-to-User Mapping via XML API

Answer

Clientless VPN

Answer

GlobalProtect Transparent Authentication

Question 5

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Accepted Answer

Vulnerability Protection. Vulnerability Protection profiles allow you to set actions like 'drop' or 'reset' for specific threat signatures.

Answer

Anti-Spyware

Answer

URL Filtering

Answer

File Blocking

Question 6

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Accepted Answer

Decrease the MTU size on the tunnel interface.. Adjusting the MSS (Maximum Segment Size) or MTU on the tunnel interface helps avoid fragmentation issues caused by VPN headers, which are a common cause of packet loss in tunnels.

Answer

Increase the GlobalProtect timeout value.

Answer

Disable hardware offloading for IPv6.

Answer

Enable IPv6 transition mechanisms on the external interface.

Question 7

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Accepted Answer

Network > GlobalProtect > Gateways > Client Settings. In the GlobalProtect Gateway configuration, under the Client Settings, the IP pool or the use of an external DHCP server can be defined.

Answer

Objects > Addresses

Answer

Network > DHCP > Server

Answer

Device > Setup > Management

Question 8

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

Accepted Answer

Add the site to the 'Allow List' in the URL Filtering profile object assigned to the security policy.. URL Filtering allows for category overrides within a profile to exempt specific sites from broad category-based blocking.

Answer

Move the security policy to the top of the policy list.

Answer

Add the site to the 'Blocked' list in the URL Filtering profile.

Answer

Create a new URL category and add the domain to it, then block that category.

Question 9

Where is the configuration located to enable the 'DNS Security' service on a specific security zone?

Accepted Answer

Policies > Security > [Rule Name] > Actions tab. DNS Security profiles are applied to security policy rules, which then process traffic from specific zones.

Answer

Objects > Security Profiles > DNS Security

Answer

Network > Zones > [Zone Name]

Answer

Device > Setup > Services > DNS

Question 10

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

Accepted Answer

System logs. System logs record infrastructure-level events, including BGP state changes and neighbor relationship transitions.

Answer

Traffic logs

Answer

Threat logs

Answer

Config logs