NetSec-Pro Practice Test 20 — 15 Questions

Question 1

You want to block a specific URL category for all users except for the 'HR' department. How should the security policy be structured?

Accepted Answer

Create an allow rule for 'HR' above a block rule for the category.. In a security policy, rules are evaluated top-down and the first match wins. To allow HR while blocking the category for everyone else, the allow rule for HR must be placed above the block rule for the category. This ensures HR traffic matches the allow rule first and bypasses the block, while all other users fall through to the block rule. This is the standard 'exception before general rule' approach in firewalls like Palo Alto, Fortinet, and Check Point.

Answer

Create a block rule for the category, then place an allow rule for 'HR' below it.

Answer

Use an Object Group to exclude HR from the block rule.

Answer

Configure a NAT rule to redirect HR traffic.

Question 2

What is the first step in the packet processing flow when a packet arrives at the firewall?

Accepted Answer

Ingress/Session lookup. When a packet arrives at a PAN-OS firewall, the very first step is the ingress/session lookup. The firewall checks its session table to see if the packet belongs to an existing session; if so, it applies the cached policy decision and forwards the packet without re-evaluating the full policy. Only if no session exists does the firewall proceed to security policy matching and other inspection stages.

Answer

Content-ID inspection

Answer

Security policy matching

Answer

User-ID mapping

Question 3

When a firewall is managed by Panorama, where is the authoritative configuration stored?

Accepted Answer

On the Panorama appliance.. Panorama serves as the central management point, making its configuration the 'source of truth' for managed devices.

Answer

On the local firewall only.

Answer

In the cloud-based license portal.

Answer

On each firewall's local storage independently.

Question 4

An administrator needs to restrict access to a specific website. Which profile should be modified?

Accepted Answer

URL Filtering. URL Filtering is the security profile that categorizes and controls web destinations, allowing administrators to block or allow specific websites, URL categories, or custom URL lists. To restrict access to a specific website, you modify the URL Filtering profile attached to the relevant security policy rule.

Answer

Data Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 5

Which TWO of the following are valid log types available on the Palo Alto Networks firewall?

Accepted Answer

Traffic. Option D (Traffic) is correct because the Palo Alto Networks firewall maintains a Traffic log that records every session traversing the firewall, including source/destination zones, IP addresses, applications, ports, and session end reasons. Option E (Threat) is correct because the firewall keeps a Threat log that records security events detected by the security profiles, such as antivirus, anti-spyware, vulnerability protection, URL filtering, and WildFire verdicts. These two are among the standard log types (alongside System, Configuration, URL Filtering, WildFire, Data Filtering, HIP Match, and Correlation). Option A (Policy-Update) is not a valid log type; policy changes are captured in the Configuration log. Option B (Hardware) is not a valid log type; hardware and system events are recorded in the System log. Option C (Encryption) is not a valid log type; decryption-related events appear in the Traffic and System logs, not a dedicated Encryption log.

Answer

Policy-Update

Answer

Hardware

Answer

Encryption

Question 6

An administrator is troubleshooting a Prisma Access remote network deployment where branch users are unable to access the internet through Prisma Access. The remote network firewall shows the IPsec tunnel to Prisma Access is up, and the service connection to the data center is also up. Branch users can access internal resources at the data center but not the internet. Which configuration issue is most likely causing this problem?

Accepted Answer

The remote network firewall's policy-based forwarding rule for internet-bound traffic is missing or misconfigured.. In a Prisma Access remote network deployment, policy-based forwarding on the remote network firewall is required to direct internet-bound traffic to the Prisma Access tunnel. If internal access works but internet does not, the PBF rule for internet traffic is likely missing or incorrect. The other options are either unrelated (service connection, GlobalProtect portal) or would not prevent traffic from reaching Prisma Access.

Answer

The service connection to the data center is down, preventing internet access.

Answer

The security policy rule allowing internet access is missing on the Prisma Access gateway.

Answer

The GlobalProtect portal is not configured to allow remote network connections.

Question 7

Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?

Accepted Answer

Enable Ping in the Interface Management Profile.. Enabling Ping in the Interface Management Profile allows ICMP echo requests to the interface IP, which can be used to verify Layer 3 connectivity to the upstream ISP. This is a common method to confirm the interface is reachable and properly connected.

Answer

Disable the interface.

Answer

Increase the ARP timeout value.

Answer

Change the interface speed to auto-negotiate.

Question 8

Which THREE of the following are actions that can be taken when a file is detected by a File Blocking Profile?

Accepted Answer

Block. In a Palo Alto Networks File Blocking Profile, the three available actions for a matched file are Block (A), Continue (B), and Alert (D). Block (A) drops the file and, depending on the application, may also reset the session, preventing the file from reaching the endpoint. Continue (B) allows the file to be transferred while still logging the event, which is useful for monitoring without disrupting traffic. Alert (D) permits the file to pass but generates a log/alert entry so administrators are notified of the transfer. Reset-Both (C) is a Security Profile action used in Antivirus, Anti-Spyware, and Vulnerability Protection profiles, not a File Blocking action, and Quarantine (E) is not a File Blocking Profile action (quarantine functionality applies to WildFire/antivirus handling, not file blocking).

Answer

Reset-Both

Answer

Quarantine

Question 9

A network security administrator is implementing a defense-in-depth strategy and needs to select controls that operate at the network layer to protect against IP spoofing and to segment traffic between VLANs. Which two controls should the administrator implement? (Choose two.)

Accepted Answer

Access Control Lists (ACLs) on routers. Unicast Reverse Path Forwarding (uRPF) validates source IP addresses to mitigate spoofing, and router ACLs filter traffic between VLANs based on network-layer criteria. Both operate at the network layer and directly address the administrator's goals. A WAF, HIPS, and email spam filter work at higher layers or on endpoints and do not provide these network-layer protections.

Answer

Web Application Firewall (WAF)

Answer

Email spam filter

Answer

Host-based intrusion prevention system (HIPS)

Question 10

What is the function of 'Application Default' in a service object?

Accepted Answer

It restricts the traffic to the standard ports defined for that application.. Selecting 'Application-Default' ensures that traffic is only allowed if it uses the port defined for that application in the App-ID database.

Answer

It assigns a random port to the traffic.

Answer

It forces the firewall to use port 80/443 only.

Answer

It automatically blocks all traffic.

Question 11

A NetSec-Pro administrator is configuring a firewall to inspect traffic between an internal trusted zone and an external untrusted zone. The security policy allows the traffic, and a security profile group is applied. However, the administrator notices that SSL decryption is not occurring, and encrypted threats are passing uninspected. Which configuration step is required to enable SSL forward proxy decryption?

Accepted Answer

Create a decryption policy rule with the action 'ssl-forward-proxy' and attach a decryption profile.. SSL forward proxy decryption is enabled by creating a decryption policy rule with the action 'ssl-forward-proxy' and attaching a decryption profile. This rule allows the firewall to act as a proxy, decrypting outbound SSL traffic, inspecting it, and re-encrypting it. Without such a rule, encrypted traffic is not decrypted, regardless of security profiles applied to the security policy.

Answer

Enable SSL decryption globally under Device > Setup > Session.

Answer

Configure a URL filtering profile with the 'decrypt' action for SSL traffic.

Answer

Add an application override for SSL to force traffic through the decryption engine.

Question 12

A security operations team is investigating a series of alerts indicating that the firewall is not blocking known malicious files. They have a WildFire license and a File Blocking profile attached to a security policy. However, users are still able to download and execute malicious executables. Which configuration issue is most likely causing this failure?

Accepted Answer

The File Blocking profile is configured to alert instead of block for the executable file type.. The File Blocking profile action determines whether a file is blocked or simply logged. If the action for the executable file type is set to 'alert', the firewall allows the download and generates a log. To block malicious executables, the action must be set to 'block'. Other factors like license expiration, direction, or decryption may affect inspection, but the most direct cause for not blocking is the profile action set to alert.

Answer

The security policy rule does not have the File Blocking profile applied to the correct direction (download).

Answer

The firewall is not configured to decrypt SSL traffic, so it cannot inspect the files.

Answer

The WildFire license is expired, so the firewall cannot query the WildFire cloud.

Question 13

Which THREE configuration elements are commonly managed via Panorama Templates?

Accepted Answer

NTP server settings. Panorama Templates are used to manage device and network settings that are pushed to managed firewalls, so NTP server settings (A) are correct because time synchronization is a device-level configuration typically defined under Device > Setup > Services in a template. Network interfaces (C) are correct because interface configuration (Layer 2, Layer 3, virtual routers, zones, etc.) is a core template-managed network setting. DNS settings (E) are also correct because DNS servers, DNS proxy, and related resolution settings are device-level parameters configured in templates. Address objects (B) and security policy rules (D) do not belong here because they are managed through Panorama Device Groups, not Templates, since they are policy-related objects and rules rather than device/network configuration.

Answer

Address objects

Answer

Security policy rules

Question 14

A company is experiencing high false-positive rates with WildFire for custom proprietary executable files. What is the recommended configuration to minimize these while maintaining security?

Accepted Answer

Create a WildFire analysis profile and add the proprietary file hashes to the WildFire File Exclusion list.. The WildFire File Exclusion list allows administrators to specify file hashes that should not be forwarded for WildFire analysis. By adding the proprietary executable hashes to this list, the firewall will skip analysis for these known-good files, reducing false positives while still analyzing all other files. This maintains security because only explicitly trusted files are excluded, and all other files continue to be inspected.

Answer

Lower the threat prevention action from block to alert for all executables.

Answer

Disable WildFire on the specific security policy rule.

Answer

Change the WildFire forwarding location to a local WildFire appliance.

Question 15

A security administrator is configuring a Security Policy rule to allow web traffic but wants to ensure that users cannot download executable files. The administrator decides to attach a File Blocking profile to the rule. Which action should be set in the File Blocking profile to prevent the download of executable files while still allowing other file types?

Accepted Answer

Set the action for the 'executable' file type to 'block'. To block executable file downloads while allowing other file types, the administrator must set the action for the 'executable' file type to 'block' in the File Blocking profile. This provides granular control, blocking only the specified file type. Other options would either block all files, only alert, or use an invalid action. The correct configuration ensures that executables are blocked without affecting other legitimate downloads.

Answer

Set the action for the 'executable' file type to 'alert'

Answer

Set the action for the 'executable' file type to 'continue'

Answer

Set the action for the 'any' file type to 'block'