NetSec-Pro Practice Test 2 — 10 Questions

Question 1

A security engineer is configuring GlobalProtect on a Palo Alto Networks firewall. The engineer wants to ensure that users are authenticated before they can access internal resources. The engineer has configured the GlobalProtect portal and gateway, but users are able to connect without providing credentials. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The GlobalProtect gateway is configured with the authentication method 'none' in the agent configuration.. In GlobalProtect gateway configuration, the authentication method is set per agent configuration under Client Settings. If it is set to 'none', users are not required to authenticate. This is a common misconfiguration when testing or when the engineer forgets to set the authentication method. To enforce authentication, the method must be set to a valid option like LDAP, RADIUS, or client certificate.

Answer

The GlobalProtect portal is configured with the authentication method 'client certificate' only, and users have valid certificates installed.

Answer

The GlobalProtect gateway is configured with the authentication method 'pre-logon' and the pre-logon tunnel is being used.

Answer

The GlobalProtect portal is configured with the authentication method 'LDAP' but the LDAP server is unreachable.

Question 2

A network security administrator is configuring a firewall to integrate with a cloud-based threat intelligence service. The administrator wants to automatically block traffic to known malicious IP addresses and domains. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create an External Dynamic List (EDL) for IP addresses and domains.. To automatically block traffic to known malicious IPs and domains using a cloud-based threat intelligence service, you must first create External Dynamic Lists (EDLs) that contain the indicators. Then, you reference these EDLs in Security Policy rules to enforce blocking. This two-step process allows dynamic updates from the external source to be immediately enforced by the firewall.

Answer

Set up a DNS Security profile with a custom category for malicious domains.

Answer

Configure a Decryption policy to inspect SSL traffic to malicious sites.

Answer

Enable WildFire inline machine learning.

Question 3

What is the primary function of the 'Panorama' context in the Web UI of a managed firewall?

Accepted Answer

To view read-only policies and objects pushed from Panorama.. When a firewall is managed by Panorama, the 'Panorama' menu context allows you to view pushed policies and configuration objects.

Answer

To configure local security policies.

Answer

To change the Panorama server IP address.

Answer

To initiate a direct sync request to Panorama.

Question 4

An analyst is investigating why a server in the DMZ zone can reach an external update site on TCP 443 even though no security rule explicitly permits that server's traffic. The firewall uses a security rule with the application set to 'ssl' and the service set to 'application-default'. Which behaviour explains the observed connectivity?

Accepted Answer

The 'ssl' application inherently allows TCP 443, and 'application-default' resolves to that port, so the rule matches. The ssl application is tied to TCP 443, and setting the service to application-default makes the rule inherit that port from the application definition. The outbound session therefore matches the rule and is permitted, which is why the server reaches the update site without a port-specific rule.

Answer

The server is using a decryption profile that bypasses policy for trusted update sites

Answer

The firewall's content inspection engine automatically permits traffic to known software update repositories

Answer

The DMZ zone has an implicit rule that allows all outbound traffic to the Untrust zone

Question 5

Which THREE types of information are contained in the Panorama 'Device Health' report?

Accepted Answer

CPU utilization. The Panorama 'Device Health' report surfaces resource-level telemetry from managed firewalls, and it explicitly includes CPU utilization (A), disk space utilization (B), and memory usage (C) as its core metrics, since these three resource dimensions are what the report is designed to monitor for capacity and performance troubleshooting. CPU utilization (A) is correct because the report tracks processor load on the managed devices. Disk space utilization (B) is correct because the report shows storage consumption so administrators can detect low-disk conditions. Memory usage (C) is correct because the report monitors RAM consumption on the firewalls. Security policy hit counts (D) are not part of Device Health; that data appears in policy/rule usage and traffic logs, not the health report. Active user count (E) is also not included, as user/session information comes from other monitoring views such as the ACC or user activity logs rather than the Device Health report.

Answer

Security policy hit counts

Answer

Active user count

Question 6

A NetSec-Pro administrator is configuring a security policy to allow access to a web application. The administrator wants to ensure that the policy enforces least privilege by restricting access to only the necessary users and applications. Which two NetSec-Pro features should be used together to achieve this? (Choose two.)

Accepted Answer

App-ID. User-ID and App-ID together enable policies that allow only specific users to access only the required application. User-ID maps IP addresses to users, and App-ID identifies the application precisely. This combination enforces least privilege by ensuring that access is granted based on both user identity and application, rather than broad IP or port-based rules.

Answer

URL Filtering profile

Answer

Service objects

Answer

Security profile group

Question 7

Which feature allows the firewall to inspect encrypted traffic for threats?

Accepted Answer

SSL Decryption. SSL Decryption (also called SSL Forward Proxy) allows the firewall to decrypt outbound and inbound SSL/TLS traffic, inspect it for threats using security profiles, and then re-encrypt it before forwarding. Without decryption, encrypted traffic bypasses threat inspection, so SSL Decryption is the required feature to inspect encrypted traffic for threats.

Answer

Threat Prevention

Answer

App-ID

Answer

User-ID

Question 8

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

Accepted Answer

Verify the Security Policy to ensure traffic is allowed from the GlobalProtect zone to the internal zone.. When GlobalProtect authentication succeeds but the session is reset, the most likely cause is that the decrypted tunnel traffic is being denied by a Security Policy rule. The GlobalProtect zone (tunnel interface) must have an explicit allow rule to the internal/trust zone for the user's applications. Checking the Security Policy first confirms whether the reset is a policy drop rather than an authentication or client issue.

Answer

Check the client's OS version.

Answer

Check the authentication server status.

Answer

Restart the GlobalProtect service.

Question 9

What is the result of having two security policies with the same source, destination, and service, but different applications?

Accepted Answer

The first policy in the list that matches the traffic will be enforced.. When two security policies have the same source, destination, and service but different applications, the first policy in the list that matches the traffic will be enforced. Firewalls evaluate policies top-down and stop at the first match, so the order of policies is critical.

Answer

The last rule in the list is always preferred.

Answer

The traffic is dropped by default.

Answer

The firewall merges the two policies.

Question 10

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Accepted Answer

Push the configuration to the new device using the existing Device Group.. Option A is correct because Panorama manages firewalls through Device Groups, so once the replacement firewall is added and its serial number is registered, the existing Device Group configuration can be pushed to it, restoring the same policy and object configuration without rebuilding anything. Option D is correct because Panorama identifies managed firewalls by serial number, so the failed device's serial number must be removed (or the device deleted) and the replacement firewall's serial number added so Panorama can manage and push policy to the new hardware. Option B is incorrect because licensing is tied to the firewall's serial number and is handled through the support/licensing portal, not by manually re-licensing every feature as a Panorama replacement step. Option C is incorrect because creating a new Device Group is unnecessary and would fragment policy; the replacement should join the existing Device Group. Option E is incorrect because a new or replacement firewall does not require a factory reset as part of the Panorama replacement workflow.

Answer

Re-license every feature manually.

Answer

Create a new Device Group for the replacement.

Answer

Reset the firewall to factory defaults.