NetSec-Pro Practice Exam 2 — 20 Questions

Question 1

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Accepted Answer

Network > GlobalProtect > Gateways > Client Settings. In Palo Alto Networks GlobalProtect, DHCP address assignment for clients is configured under Network > GlobalProtect > Gateways > [Gateway] > Client Settings, where the administrator specifies the IP pool and can select DHCP as the address assignment method. This is where the gateway tells connecting clients how to obtain their tunnel IP, so it is the correct location for this setting.

Answer

Objects > Addresses

Answer

Network > DHCP > Server

Answer

Device > Setup > Management

Question 2

Which of the following are types of Dynamic Updates? (Choose TWO)

Accepted Answer

Antivirus. In Palo Alto Networks PAN-OS, Dynamic Updates are the content and signature packages that the firewall downloads from the update server to keep its security engines current, and the two types asked for here are Antivirus (option B) and Applications and Threats (option C). Antivirus updates deliver the antivirus signature database used by the antivirus and WildFire security profiles to detect malware, so B is correct. Applications and Threats updates deliver the App-ID application signatures, threat signatures, and vulnerability protection content used by security policies, so C is correct. Firmware (A) is a PAN-OS software image upgrade rather than a Dynamic Update, External Dynamic Lists (D) are user-defined lists of IPs/domains/URLs imported for policy enforcement, and Certificate Revocation List (E) is a certificate-status mechanism, none of which are Dynamic Update types.

Answer

Firmware

Answer

External Dynamic Lists

Answer

Certificate Revocation List

Question 3

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

Accepted Answer

The PBF rule must be placed in the policy and reference a valid egress interface or next hop.. Policy-Based Forwarding (PBF) requires a rule that specifies a valid egress interface or next hop for matching traffic. Without a properly defined forwarding action (interface or next hop), the PBF rule cannot direct traffic, and it will not function. The rule must also be placed in the policy correctly and match the desired traffic.

Answer

The destination must always be an IP address object.

Answer

PBF must be enabled at the global configuration level.

Answer

PBF can only be used on Layer 2 interfaces.

Question 4

A security analyst is reviewing a packet capture and observes that a single TCP SYN packet sent to a closed port on an internal server elicits a TCP RST response, while the same SYN sent to a filtered port receives no response at all. Which statement best describes what the analyst is observing?

Accepted Answer

The RST means the port is closed, and the silent drop indicates the port is filtered by a device. In TCP scanning semantics, a RST reply to a SYN means the port is closed because the host is up but no listener exists. A complete absence of any reply indicates a filtering device dropped the packet, classifying the port as filtered. The combination of one closed and one filtered port confirms the host is online behind a filtering control.

Answer

The RST indicates the port is open and the service is accepting connections

Answer

Both responses indicate the ports are open but the services are misconfigured

Answer

The lack of response to the filtered port proves the host is offline

Question 5

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Accepted Answer

Performance metrics (latency, jitter, loss).. The SD-WAN policy uses Performance Probes to measure latency, jitter, and packet loss to select the best path.

Answer

Source IP address.

Answer

Static cost metrics.

Answer

Interface priority only.

Question 6

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Accepted Answer

The final verdict (e.g., Malware, Benign).. Option C is correct because the WildFire Analysis log records the final verdict returned by WildFire for the submitted sample, such as Malware, Benign, Grayware, or Phishing, which is the primary purpose of the log. Option E is correct because the WildFire Analysis log includes the MD5 hash (and typically SHA-256) of the analyzed file, which uniquely identifies the sample and is used to correlate submissions and verdicts. Options A, B, and D are not part of the WildFire Analysis log: username attribution, total bandwidth consumed by the transfer, and the physical port number used for upload are not fields WildFire reports, since the log focuses on file identification and the malware verdict rather than user or transport-layer details.

Answer

The username of the person who downloaded the file.

Answer

The total bandwidth used by the file transfer.

Answer

The physical port number used for the upload.

Question 7

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

Accepted Answer

Address Group. An Address Group in PAN-OS is a named object that contains multiple IP addresses, IP ranges, or subnets, and can also include other Address Groups. It is used in security policies to simplify management when the same set of addresses needs to be referenced in multiple rules. This directly matches the requirement to group multiple IP addresses.

Answer

Application Group

Answer

Tag

Answer

Service Group

Question 8

Which of the following is an example of a Security Profile?

Accepted Answer

Vulnerability Protection. Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering are all Security Profiles.

Answer

Policy Rule

Answer

Interface Configuration

Answer

Address Object

Question 9

An administrator wants to use User-ID. What is the primary benefit of mapping IP addresses to usernames?

Accepted Answer

To enable policy enforcement based on user or group membership.. User-ID allows security policies to be based on identities rather than IP addresses.

Answer

To increase firewall throughput.

Answer

To reduce the number of address objects.

Answer

To bypass the need for SSL decryption.

Question 10

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Accepted Answer

The session has not yet terminated.. By default, logs are generated when the session ends. If a session is very long, it may need a log interval configured to generate interim logs.

Answer

The 'Log at Session Start' option was not checked.

Answer

The log buffer is full.

Answer

The session is being decrypted.

Question 11

An administrator needs to prevent a specific file type (e.g., .exe) from being downloaded. Which profile is used?

Accepted Answer

File Blocking Profile. File Blocking Profiles allow administrators to filter files by type and direction.

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 12

Where do you generate a 'Device Deployment' token for adding a new firewall to Strata Cloud Manager?

Accepted Answer

SCM Inventory/Device Management. The SCM dashboard provides the 'Add Device' or 'Deployment' section to generate tokens for secure device registration.

Answer

Customer Support Portal

Answer

Local Firewall CLI

Answer

Panorama Settings

Question 13

You are using SCM to manage firewall policies. You want to audit who made a specific change to a security policy rule. Which feature should you use?

Accepted Answer

Audit Logs / Configuration Logs. The 'Audit Log' or 'Configuration Log' in SCM tracks all changes, including the timestamp and the administrator who performed the action.

Answer

System Logs

Answer

Threat Logs

Answer

Device Health Logs

Question 14

When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?

Accepted Answer

Device Groups. Device Groups allow for hierarchical organization of firewalls, enabling targeted policy application.

Answer

Panorama Templates

Answer

Address Groups

Answer

Policy Groups

Question 15

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

Accepted Answer

Apply Security Profiles to the inter-zone policy rule.. Security Profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and WildFire Analysis) are the components that actually inspect traffic for threats. Applying them to an inter-zone Security Policy rule enables content inspection on traffic permitted between the two zones. Without Security Profiles attached, the rule only performs allow/deny based on zone, address, user, and application — no threat scanning occurs.

Answer

Enable inter-zone routing.

Answer

Configure a virtual wire.

Answer

Change the zones to a single zone.

Question 16

A NetSec-Pro administrator needs to configure a new security policy rule on a next-generation firewall to allow HTTP traffic from the trust zone to the untrust zone. The administrator wants to ensure that the rule is placed at the top of the rulebase so that it is evaluated before any other rules. Which action should the administrator take when creating the rule?

Accepted Answer

Select 'Add rule to top' in the rule creation dialog.. When creating a security policy rule, the administrator can choose to add it to the top of the rulebase. This ensures the rule is evaluated first, which is critical when the rule must take precedence over existing rules. Selecting 'Add rule to top' is the direct and correct method to achieve this without manual reordering.

Answer

Select 'Add rule to bottom' in the rule creation dialog.

Answer

Create the rule with any position and then use a policy optimizer to reorder rules.

Answer

Leave the default position and manually drag the rule to the top after creation.

Question 17

An administrator is configuring a SASE deployment with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is inspected by the NGFW security stack while traffic to unsanctioned applications is blocked. The administrator has already configured the Prisma Access mobile users globalprotect infrastructure and added the SaaS applications to the SaaS application list. Which component must be configured next to enforce this policy for remote users?

Accepted Answer

A SaaS Security policy rule that references the SaaS application list and specifies the action for sanctioned and unsanctioned applications. SaaS Security policy in Prisma Access is designed to control access to SaaS applications using the SaaS application list. It allows administrators to define actions for sanctioned and unsanctioned applications, ensuring that remote users' traffic is handled according to policy. The other options either do not use the SaaS application list or serve different purposes such as decryption or URL categorization.

Answer

A URL Filtering profile attached to the Security policy rule that categorizes the SaaS applications

Answer

A Security policy rule with the SaaS application as the destination and an action of allow or deny

Answer

A Decryption policy rule that decrypts traffic to the SaaS applications so that App-ID can identify them

Question 18

An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?

Accepted Answer

Create a security policy with a Source User-ID for the VPN user and a Destination Object for the server.. The most secure method is to create a security policy that uses a Source User-ID for the specific VPN user and a Destination Object for the internal server, which enforces least-privilege access based on identity rather than IP. This ties the policy to the authenticated user, so only that user can reach the server, regardless of which IP the VPN assigns.

Answer

Set the user to 'Any' in the security policy.

Answer

Create a NAT policy to map the user's IP to the server.

Answer

Assign the VPN user a unique IP pool.

Question 19

You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?

Accepted Answer

Policy Test Tool (test security-policy-match). The Policy Test Tool (test security-policy-match) is purpose-built to simulate a flow against the current rulebase and report exactly which Security Policy rule matches or whether the default deny is hit. It lets you specify source zone, destination zone, source/destination IP, user, application, and service to see the rule evaluation result. This directly answers which rule is hitting the traffic.

Answer

Packet Capture (pcap)

Answer

GlobalProtect logs

Answer

Traffic Monitor

Question 20

Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?

Accepted Answer

MFA Profile. Multi-Factor Authentication (MFA) profiles are integrated into the Authentication Policy to enforce secondary verification.

Answer

Authentication Portal

Answer

Credential Protection Profile

Answer

GlobalProtect Authentication Override