NetSec-Pro Practice Exam 3 — 20 Questions

Question 1

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

Accepted Answer

It detects and blocks the submission of enterprise credentials to untrusted or newly registered websites.. Credential Phishing prevention in Advanced URL Filtering detects when a user submits enterprise credentials to an untrusted or newly registered website, even if the site is not yet on a known-malicious URL list. It uses heuristics and site-reputation signals to identify credential submission to suspicious destinations and blocks it. This is behavior-based rather than purely signature-based.

Answer

It analyzes the URL to determine if it is a known malicious site.

Answer

It requires an agent installed on the endpoint to monitor browser activity.

Answer

It monitors all inbound traffic for known phishing signatures.

Question 2

A security administrator needs to allow the NetSec-Pro management plane to authenticate firewall administrators against the corporate Microsoft Active Directory. The AD servers are reachable only on the internal network. Which server profile type should the administrator configure on the firewall to meet this requirement?

Accepted Answer

LDAP server profile. To authenticate firewall administrators against Microsoft Active Directory, the management plane needs to query the directory for user and group objects. An LDAP server profile provides the server address, port, and bind credentials for that query, enabling role-based admin access. Kerberos, RADIUS, and TACACS+ profiles serve different authentication purposes and do not provide the directory browsing required for AD group mapping.

Answer

Kerberos server profile

Answer

TACACS+ server profile

Answer

RADIUS server profile

Question 3

A network administrator is troubleshooting a Prisma Access deployment where remote users are unable to access internal applications. The administrator suspects that the issue is related to the service connection configuration. Which component is responsible for routing traffic between Prisma Access and the corporate network?

Accepted Answer

Service connection. Service connections in Prisma Access are dedicated IPSec tunnels that connect the Prisma Access infrastructure to the corporate network, allowing remote users to reach internal applications. Remote networks are for branch connectivity, mobile user locations are compute locations, and explicit proxy is for web traffic forwarding. The service connection is the critical component for internal access.

Answer

Mobile user location

Answer

Remote network

Answer

Explicit proxy

Question 4

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

Accepted Answer

System Logs.. System Logs (A) are essential because they record control-plane and system-level events such as interface up/down transitions, routing or DHCP failures, and daemon errors that directly explain why a user's traffic cannot reach the internet. Traffic Logs (C) are essential because they show the actual session-level flow of the user's packets—source/destination, port, application, and allow/deny disposition—revealing whether traffic is being dropped, misrouted, or never leaving the device. Together these two logs cover both the underlying system state and the live traffic behavior needed to isolate an internet-connectivity failure. Decryption Logs (B) only matter for inspecting encrypted sessions and are irrelevant when basic connectivity is broken, Config Logs (D) merely track configuration changes rather than runtime connectivity state, and Threat Logs (E) only show security-policy hits such as exploits or malware, which are not required to diagnose a simple inability to reach the internet.

Answer

Decryption Logs.

Answer

Config Logs.

Answer

Threat Logs.

Question 5

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

Accepted Answer

It provides real-time, cloud-based analysis of unknown or newly registered domains.. Advanced URL Filtering adds real-time, cloud-based inline analysis of unknown or newly registered domains, using machine learning and threat intelligence to categorize and block malicious sites that signature-based URL filtering would miss. Standard URL filtering relies on a static, periodically updated database, so zero-day or newly registered malicious domains can slip through until the next update.

Answer

It allows the firewall to bypass SSL decryption for certain categories.

Answer

It includes an integrated VPN client for remote workers.

Answer

It allows for more custom URL categories.

Question 6

An administrator is configuring a NetSec-Pro firewall to prevent users from downloading executable files (.exe) from the internet. Which profile should be applied to the Security Policy rule to block this file type?

Accepted Answer

File Blocking profile. File Blocking profiles are used to block specific file types based on extension or magic bytes. To prevent .exe downloads, the administrator should configure a File Blocking profile with the executable file type set to block, and apply it to the Security Policy rule. Other profiles like Antivirus or Vulnerability Protection do not block by file type.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Antivirus profile

Question 7

A security operations analyst notices that a workstation in the trust zone is repeatedly attempting connections to an external IP address on TCP port 4444, a port commonly associated with remote access trojans. The security policy currently allows the workstation to reach any external destination on any port because of a legacy any-any outbound rule. The analyst wants to block this specific behavior without disrupting legitimate business traffic. Which action should the analyst take first?

Accepted Answer

Create a security policy rule above the legacy rule that denies the specific external IP address and port combination. Security policy rules are evaluated in order, so inserting a specific deny rule above the broad legacy allow rule stops the malicious flow before the permissive rule can match. This containment action addresses the immediate threat while preserving existing business connectivity, and it can be followed later by a broader policy cleanup.

Answer

Enable DNS sinkholing for the external IP address in the anti-spyware profile

Answer

Delete the legacy any-any outbound rule and replace it with a default deny rule

Answer

Add the external IP address to a URL Filtering profile applied to the workstation's outbound rule

Question 8

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Accepted Answer

The client sent a SYN packet but the server did not respond.. The 'incomplete' App-ID usually signifies that the TCP three-way handshake did not complete, or the application traffic ceased before it could be identified.

Answer

The Security Policy is missing a Decryption Profile.

Answer

The App-ID database is outdated.

Answer

The application is using a custom port not defined in the Service object.

Question 9

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

Accepted Answer

To redirect requests for malicious domains to a specific IP address to alert the administrator.. A DNS sinkhole works by intercepting DNS responses for domains that the security profile has flagged as malicious (based on threat signatures, PAN-DB/Advanced DNS categories, or DNS Security feeds). Instead of returning the real IP, the firewall rewrites the response to point to a sinkhole IP (typically 72.5.65.111 or a configured internal address). This blocks the connection and generates a log entry so the administrator can see which internal host attempted to reach the malicious domain.

Answer

To encrypt DNS traffic between the firewall and the ISP.

Answer

To allow a firewall to act as a DNS server for internal clients.

Answer

To cache DNS queries to improve network performance.

Question 10

A NetSec-Pro administrator is deploying a new branch office firewall. The security team requires that all traffic from the branch to the internet be inspected for threats, but they do not want to decrypt traffic due to privacy concerns. Which type of security profile should be applied to the outbound security policy to detect threats in unencrypted traffic without performing SSL decryption?

Accepted Answer

Vulnerability Protection profile. The Vulnerability Protection profile is specifically designed to detect and block exploits and malware in network traffic without requiring decryption. It inspects clear-text protocols and can be applied to security policies to enforce threat prevention. Since the branch office wants to inspect traffic for threats but not decrypt, this profile meets the requirement without compromising privacy.

Answer

File Blocking profile

Answer

SSL Decryption profile

Answer

Data Filtering profile

Question 11

A network security engineer is configuring a Palo Alto Networks firewall to integrate with a SASE solution using GlobalProtect. The requirement is to ensure that traffic from remote users is inspected by the firewall's security profiles before being forwarded to the internet. The engineer has configured a GlobalProtect portal and gateway, and users can connect. However, traffic from remote users is not being inspected by security profiles. What is the most likely missing configuration?

Accepted Answer

The GlobalProtect gateway is not configured to route all client traffic through the tunnel (split tunnel is enabled).. For GlobalProtect to inspect all remote user traffic, the gateway must be configured to route all traffic through the tunnel. If split tunneling is enabled, internet-bound traffic bypasses the firewall. Security profiles on the policy rule are necessary but only effective if traffic traverses the firewall. Decryption and certificates are unrelated to the routing issue. Therefore, the missing configuration is the tunnel mode setting.

Answer

The GlobalProtect portal configuration does not include the correct client certificate for authentication.

Answer

The firewall's SSL decryption policy is not configured to decrypt traffic from GlobalProtect users.

Answer

The security policy rule allowing traffic from the GlobalProtect zone to the internet does not have security profiles attached.

Question 12

An administrator notices that the 'Commit' progress on Panorama hangs at 99%. What is the most effective way to troubleshoot this?

Accepted Answer

Check the 'Tasks' menu in Panorama for detailed error logs on the specific job.. The task manager in Panorama shows the status of ongoing jobs, and clicking on the job ID reveals detailed logs of the push process.

Answer

Reboot the Panorama appliance.

Answer

Clear the configuration cache on the firewall.

Answer

Increase the timeout value in Management Settings.

Question 13

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

Accepted Answer

Install the firewall's Forward Trust Certificate on all client devices.. For SSL Forward Proxy to inspect encrypted traffic, the firewall acts as a man-in-the-middle by presenting a certificate to the client that is signed by the firewall's Forward Trust Certificate. For the client to trust this certificate without errors, the Forward Trust Certificate (or its CA) must be installed in the client's trusted root store. Without this, clients will see certificate warnings and may block the connection, preventing inspection.

Answer

Enable SSH decryption on the management interface.

Answer

Configure a static IP address for the Decryption Broker.

Answer

Disable Certificate Revocation List (CRL) checks.

Question 14

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

Accepted Answer

WildFire. WildFire is Palo Alto Networks' cloud-based malware analysis and prevention service that inspects files using signatures, heuristics, and dynamic sandbox analysis. It detects unknown and zero-day threats by executing files in a virtual environment and observing behavior. WildFire verdicts are then shared globally to protect all subscribers.

Answer

URL Filtering

Answer

App-ID

Answer

User-ID

Question 15

You are configuring 'Log Forwarding' from Panorama to an external SIEM. Which object must you define in Panorama to facilitate this?

Accepted Answer

Log Forwarding Profile. Panorama log forwarding to an external SIEM is configured by attaching a Log Forwarding Profile to a log forwarding destination. The Log Forwarding Profile defines which log types are forwarded, the filter, and the target server (Syslog, SNMP, email, HTTP, etc.). Without this profile, Panorama has no rule set that tells it what to send and where.

Answer

Log Collector Profile

Answer

Reporting Profile

Answer

External Service Profile

Question 16

A network security administrator is configuring a Palo Alto Networks firewall to integrate with a directory service for user identification. They want to ensure that security policies can enforce rules based on user and group information. Which component must be configured to map IP addresses to user identities?

Accepted Answer

User-ID Agent. User-ID is the feature that maps IP addresses to user identities by collecting information from directory servers. The User-ID Agent (or integrated agent) performs this mapping, enabling security policies to use user and group as criteria. Other components like GlobalProtect, LDAP Server Profile, or Kerberos keytab support authentication or directory access but do not directly provide the IP-to-user mapping required for policy enforcement.

Answer

Kerberos Keytab

Answer

GlobalProtect Agent

Answer

LDAP Server Profile

Question 17

A network administrator is reviewing the TCP/IP model layers while troubleshooting a connectivity issue. The administrator needs to identify which layer is responsible for logical addressing and routing of packets across multiple networks. Which layer of the TCP/IP model performs this function?

Accepted Answer

Internet layer. In the TCP/IP model, the Internet layer is responsible for logical addressing and routing. It uses IP addresses to identify hosts and routers, and routing protocols to determine paths across networks. The Transport layer handles end-to-end connections, while the Network Access layer deals with local link delivery, and the Application layer supports user-facing protocols.

Answer

Transport layer

Answer

Application layer

Answer

Network Access layer

Question 18

An administrator needs to enable NetSec-Pro Clientless VPN for remote users. The portal is configured with a valid certificate and authentication profile. Users report that the portal loads, but no internal web applications are accessible. Which additional component must be configured to allow access to internal web applications?

Accepted Answer

Add the internal web applications to the Clientless VPN application list.. Clientless VPN requires a list of internal web applications to be defined so that the portal can present and proxy them. Without this list, users can authenticate and see the portal but cannot access any internal applications. The other options address traffic handling or inspection but do not populate the portal with applications.

Answer

Create a Security Policy rule allowing traffic from the untrust zone to the trust zone.

Answer

Configure an Application Override policy for the internal web servers.

Answer

Enable SSL decryption for the internal web servers.

Question 19

You have a security policy that allows 'any' application. What is the security risk of this configuration?

Accepted Answer

Increased risk of hidden threats using allowed ports.. Allowing 'any' application bypasses the granular control of App-ID, potentially allowing malicious traffic through common ports like 80/443.

Answer

The firewall will drop all traffic.

Answer

Performance overhead.

Answer

The firewall cannot log the traffic.

Question 20

Which SCM feature allows you to view the health status of your entire global firewall deployment?

Accepted Answer

Dashboard. The SCM 'Dashboard' provides a high-level overview, including device health and connectivity status.

Answer

Report Generator

Answer

Device Inventory

Answer

Policy Monitor