NetSec-Pro Practice Exam 4 — 20 Questions

Question 1

Which THREE items are included in a Panorama configuration 'Export'?

Accepted Answer

Security policy rules. Option A (Security policy rules) is correct because Panorama's Export function saves the device-group policy configuration, including security rules, as part of the exported XML/configuration bundle. Option B (Template network configurations) is correct because template stacks and their network settings (interfaces, zones, virtual routers, etc.) are part of the Panorama configuration and are included in the export. Option E (Address and Service objects) is correct because these are configuration objects stored in Panorama and referenced by policy, so they are exported along with the rest of the config. Option C (Log data files) is not included because logs reside in the logging storage and are not part of a configuration export. Option D (Historical threat reports) is not included because reports are generated data/artifacts, not configuration, and are not part of the export.

Answer

Log data files

Answer

Historical threat reports

Question 2

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Accepted Answer

Automatic updates and feature availability.. SCM provides cloud-native benefits such as reduced infrastructure overhead and automated updates.

Answer

Direct root access to the management server.

Answer

Support for legacy PAN-OS versions 6.0 and below.

Answer

Ability to host custom local scripts.

Question 3

Which command is used to display the current User-ID mapping information on the CLI?

Accepted Answer

show user ip-user-mapping all. The command 'show user ip-user-mapping all' provides the current IP to username mapping table.

Answer

show logging user-id

Answer

test user-id

Answer

show system user-id

Question 4

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

Accepted Answer

Panorama. Panorama is the primary tool for centralized management, visibility, and logging (when used with Panorama Logging).

Answer

Cortex XDR

Answer

Threat Vault

Answer

Customer Support Portal

Question 5

Why should you use an App-ID 'Group' in a security policy?

Accepted Answer

To reduce policy rule count and simplify management.. App-ID groups simplify policy management by allowing you to update the group once rather than individual policies.

Answer

To force traffic over specific ports.

Answer

To enable SSL decryption for those applications.

Answer

To increase security by blocking unknown traffic.

Question 6

When configuring a zone, what is the primary security benefit of selecting 'Enable User Identification'?

Accepted Answer

It allows the firewall to map IP addresses to usernames for policy enforcement.. Enabling User Identification on a zone allows the firewall to map source IP addresses to usernames (via User-ID agents, terminal services agents, or captive portal) so that security policies can be written based on users or groups rather than just IP addresses. This provides identity-based policy enforcement, which is the primary security benefit of the feature.

Answer

It protects the zone from SYN flood attacks.

Answer

It forces all traffic in the zone to be decrypted.

Answer

It automatically enables log forwarding to Panorama.

Question 7

An administrator is using the Strata Cloud Manager API to programmatically create a security rule. The API request fails with a 400 Bad Request error. The administrator has verified that the authentication token is valid and the endpoint URL is correct. Which of the following is the most likely cause of the error?

Accepted Answer

The API request is missing a required HTTP header, such as 'Content-Type: application/json'.. A 400 Bad Request error in the SCM API usually indicates a malformed request. Common causes include missing required HTTP headers like 'Content-Type: application/json', invalid JSON syntax, or missing required fields. Since the token and URL are correct, the administrator should inspect the request headers and body for compliance with the API specification.

Answer

The API endpoint URL is incorrect and points to a non-existent resource.

Answer

The security rule name contains special characters that are not allowed.

Answer

The API token has expired and needs to be refreshed.

Question 8

A security administrator needs to configure a Palo Alto Networks firewall to send logs to an external syslog server. The logs should include traffic, threat, and URL filtering data. Which type of profile should be configured to forward these logs?

Accepted Answer

Log Forwarding Profile. A Log Forwarding Profile is used to specify which logs are forwarded to external syslog servers. It matches on log types and attributes and references server profiles that contain the syslog server details. This is the correct configuration object to meet the requirement.

Answer

Security Policy Rule

Answer

Syslog Profile

Answer

Server Profile

Question 9

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Accepted Answer

The application signature does not match the traffic's port or pattern.. When creating a custom application object, the signature must correctly match the traffic's port and pattern. If the signature does not match the actual traffic characteristics (e.g., wrong port, incorrect pattern matching, or missing context), the firewall will not identify the application as the custom App-ID, and the Security Policy referencing that App-ID will not match, resulting in a deny.

Answer

The application must be assigned to the 'web' category.

Answer

The App-ID must be added to a service group.

Answer

The application requires an SSL decryption policy first.

Question 10

What is the purpose of the 'Zone Protection Profile'?

Accepted Answer

To defend against reconnaissance and floods at the zone ingress.. Zone Protection Profiles are used to defend against reconnaissance (e.g., port scans) and flood attacks (e.g., SYN, UDP, ICMP floods) at the zone ingress. They are applied to zones and provide protection before traffic reaches security policies.

Answer

To enforce SSL decryption on traffic within the zone.

Answer

To protect the management plane from web attacks.

Answer

To map IP addresses to user identities.

Question 11

A NetSec-Pro administrator is troubleshooting why a user cannot access a specific SaaS application. The security policy allows the application, but traffic is being denied. The administrator suspects that the application is being identified incorrectly. Which NetSec-Pro feature can be used to verify the application identification and take corrective action?

Accepted Answer

Application Command Center (ACC). The Application Command Center (ACC) provides a centralized view of application usage and threat activity, including which applications are being identified. By using ACC, the administrator can confirm whether the SaaS application is correctly identified. If not, an Application Override policy can be applied to force the correct identification, resolving the access issue.

Answer

Session Browser

Answer

Application Override policy

Answer

Packet Capture

Question 12

When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?

Accepted Answer

Deny all traffic by default.. In a Zero Trust environment, the principle of least privilege is paramount. The default interzone policy should deny all traffic by default, and then explicit rules should be created to allow only necessary traffic based on identity, context, and other factors. This ensures that no traffic is implicitly trusted.

Answer

Allow all internal traffic, deny external.

Answer

Allow traffic based on source IP only.

Answer

Allow all traffic to simplify configuration.

Question 13

An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?

Accepted Answer

Through the scheduled 'Threats' dynamic update package.. The 'Threats' dynamic update package is the mechanism that delivers new and updated threat signatures (antivirus, anti-spyware, vulnerability protection) to the firewall. It is scheduled via Device > Dynamic Updates and can be set to download and install automatically. This package contains the signatures needed to detect and block zero-day exploits, as long as the firewall has a valid Threat Prevention license.

Answer

By manually downloading the threat signature database from the Customer Support Portal.

Answer

Through the daily WildFire update package.

Answer

By enabling the 'Automatic Update' feature in the Device > Software menu.

Question 14

You need to create a global address object that is available to all firewalls managed by Panorama. Where should you define this?

Accepted Answer

In the 'Shared' device group.. Shared objects are defined in the 'Shared' device group to make them available across all devices.

Answer

In the local firewall's Address tab.

Answer

In the root Template stack.

Answer

In the Policy Optimizer.

Question 15

A network administrator is configuring a Palo Alto Networks firewall and wants to ensure that security policy rules are evaluated in the correct order. They have created several rules with different source and destination zones. Which factor determines the order in which security policy rules are evaluated?

Accepted Answer

The rule's position in the security policy rulebase, from top to bottom.. Security policy rules are evaluated from top to bottom in the rulebase. The first rule that matches the traffic is enforced, and no further rules are checked. This sequential evaluation means that rule order directly affects security outcomes. Other factors such as creation time, priority values, or zone pairs do not influence evaluation order. Administrators must carefully order rules to achieve the desired allow or deny behavior.

Answer

The rule's priority value, which is set in the rule's advanced settings.

Answer

The rule's creation timestamp, with older rules evaluated first.

Answer

The rule's zone pair, with intra-zone rules evaluated before inter-zone rules.

Question 16

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?

Accepted Answer

The security policy is configured with the action 'Allow' but the profile setting is set to 'None'.. Security profiles are applied to traffic only if they are attached to the matching security policy rule. In the rule's Actions tab, the Profile Setting must be configured with a Security Profile Group or individual profiles. If it is left as 'None', the firewall allows the traffic but does not inspect it with any profiles. This is a common oversight when creating new rules.

Answer

The security policy is configured with a source and destination zone that do not match the traffic.

Answer

The security policy is using the 'Application Default' action instead of 'Allow'.

Answer

The security policy is set to 'Allow' but the 'Log at Session End' is disabled, which also disables security profile inspection.

Question 17

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

Accepted Answer

GlobalProtect App. The GlobalProtect App (B) is the endpoint client installed on mobile users' laptops and devices; it initiates the tunnel and enforces security policy on the endpoint, making it a core component of Prisma Access mobile user protection. The GlobalProtect Gateway (D) is the Prisma Access service infrastructure that terminates the GlobalProtect tunnels from mobile users and applies security policy in the cloud. The Identity Provider (E), using SAML or LDAP, is required to authenticate mobile users and enable identity-based policy enforcement before access is granted. Service Connection (A) is used to connect remote networks and data centers to Prisma Access, not mobile users, and a Local Branch Firewall (C) is a remote network component rather than part of the mobile user architecture.

Answer

Service Connection

Answer

Local Branch Firewall

Question 18

When using App-ID, what happens if traffic matches a policy allowing 'web-browsing' but the application is actually 'facebook-base'?

Accepted Answer

The traffic is dropped because it does not match the allowed application.. App-ID identifies the actual application, not just the port or protocol. If a policy allows 'web-browsing' but the traffic is identified as 'facebook-base', it does not match the allowed application. By default, the firewall denies traffic that does not match any rule, so the traffic is dropped. This enforces application-level control.

Answer

The traffic is allowed because Facebook uses HTTP.

Answer

The firewall allows it but flags the log as 'unknown'.

Answer

The firewall automatically updates the policy.

Question 19

Which action should be taken after performing a firmware upgrade on a Palo Alto Networks firewall to ensure all components are up to date?

Accepted Answer

Install the latest Dynamic Updates for App-ID and Threats.. After a firmware upgrade, the firewall's App-ID and Threat signatures may be outdated. Installing the latest Dynamic Updates ensures that the firewall has the most current application signatures and threat prevention capabilities, which are separate from the firmware itself.

Answer

Immediately reboot the device again.

Answer

Re-import the entire configuration XML file.

Answer

Factory reset the device.

Question 20

When configuring an interface for DHCP client, where do you set the default gateway?

Accepted Answer

The gateway is learned via the DHCP server response.. When an interface is configured as a DHCP client, the default gateway is not manually configured anywhere in the GUI — it is learned dynamically from the DHCP server's response (specifically the router option, DHCP option 3). The firewall installs this gateway into its virtual router's routing table automatically, so no static route or manual gateway entry is required. This is why the correct answer is that the gateway is learned via the DHCP server response.

Answer

Network > Interfaces > Advanced

Answer

Device > Setup > Services

Answer

Network > Virtual Router > Static Routes