NetSec-Pro Practice Test 21 — 15 Questions

Question 1

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

Accepted Answer

Data Filtering. Data Filtering profiles scan traffic for specific patterns, such as regular expressions for credit card numbers.

Answer

Vulnerability Protection

Answer

URL Filtering

Answer

Antivirus

Question 2

An engineer is deploying a new Palo Alto Networks firewall and needs to enable DNS sinkholing for malware command-and-control domains. The firewall must respond to internal clients with a sinkhole IP address when they query known malicious domains. Which configuration step is required to make the firewall perform DNS sinkholing?

Accepted Answer

Configure a DNS Sinkhole action in the Anti-Spyware security profile and set the sinkhole IPv4 address to a dedicated internal IP that clients can reach.. DNS sinkholing is a feature of the Anti-Spyware security profile. When the firewall detects a DNS query for a known malicious domain, it can respond with a sinkhole IP address instead of the real IP. This prevents clients from reaching command-and-control servers. The sinkhole IP must be reachable by clients, often an internal server or a firewall data-plane interface, to redirect and potentially quarantine the client.

Answer

Enable DNS sinkholing globally under Device > Setup > Session and specify a sinkhole IP address that the firewall will use for all DNS responses.

Answer

Enable DNS sinkholing in the Security Profile's Antivirus profile and set the sinkhole IP address to the firewall's management interface IP.

Answer

Create a custom URL Filtering profile that blocks all DNS queries and redirects them to a captive portal for user authentication.

Question 3

A security engineer at a financial services company is designing segmentation for a new data center. The requirement is that the web tier (VLAN 20) must never initiate connections to the database tier (VLAN 30), but the database tier must be able to initiate connections to the web tier for replication. Which security policy configuration on a Palo Alto Networks firewall best enforces this requirement?

Accepted Answer

Create a security policy from the web zone to the database zone with the action set to deny, and a separate policy from the database zone to the web zone with the action set to allow.. PAN-OS security policies are unidirectional: each new session is matched against rules based on its source and destination zones. To allow database-initiated replication while blocking web-initiated access, you need a deny rule for the web-to-database direction and an allow rule for the database-to-web direction. Authentication or DoS profiles do not replace this zone-based directional control.

Answer

Create a single security policy between the web zone and the database zone with the action set to allow, and rely on the application's authentication to prevent unauthorized access.

Answer

Create a security policy from the web zone to the database zone with the action set to allow, and apply a Denial-of-Service protection profile to the database zone to block web-initiated connections.

Answer

Create a security policy from the web zone to the database zone with the action set to deny, and configure the database zone as a 'sinkhole' zone to drop all traffic.

Question 4

An administrator needs to create a backup of the current configuration. Which file type is recommended for an off-box manual restore?

Accepted Answer

The 'running-config.xml' file.. The running-config.xml file contains the complete active configuration of the firewall, including all policies, objects, network settings, and security profiles. It is the recommended file type for off-box manual restore because it can be directly imported back into the device to restore the full configuration state. Unlike device state backups, it is human-readable and portable across compatible PAN-OS versions.

Answer

Exported 'Device State' (.tar.gz).

Answer

The 'software.img' file.

Answer

The 'bootstrap.xml' file.

Question 5

A junior administrator is reviewing how a PAN-OS firewall handles a brand-new TCP session between a client in the Trust zone and a web server in the Untrust zone. They want to confirm which component performs the actual security policy lookup for that first packet before any session entry exists. Which component is responsible?

Accepted Answer

The dataplane, using the first packet to perform the policy lookup and create a session entry. When a session does not yet exist in the session table, the initial packet is delivered to the dataplane, which performs the security policy lookup, applies the matching rule, and installs a session entry. Later packets in the same flow hit that session entry directly, so the full policy lookup happens only once per session.

Answer

The control plane, which runs routing protocols and therefore decides policy for each packet

Answer

The management plane, which logs in and performs the policy lookup on behalf of the dataplane

Answer

The external authentication server, which validates the user before any packet is allowed

Question 6

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW for a SASE deployment. Remote users connect through Prisma Access, and the security team wants to enforce consistent security policies that inspect traffic based on application identity rather than just port and protocol. The administrator needs to ensure that the firewall can identify applications even when they use non-standard ports or encryption. Which Palo Alto Networks technology should the administrator rely on to achieve this?

Accepted Answer

App-ID. App-ID is the foundational technology in Palo Alto Networks NGFWs that identifies applications regardless of port, protocol, or encryption. It uses signatures, decryption, and behavioral analysis to classify traffic, enabling security policies based on application identity. In a SASE deployment with Prisma Access, App-ID ensures consistent enforcement across remote users, which is precisely what the administrator requires to inspect traffic beyond port-based rules.

Answer

Content-ID

Answer

User-ID

Answer

SSL Decryption

Question 7

A security architect is reviewing a design where a Palo Alto Networks firewall will inspect traffic between two internal segments that are both connected to the same firewall. The architect wants to ensure that traffic between the segments is subject to security policy and threat inspection rather than being allowed implicitly. The two segments are currently assigned to different subnets but the same security zone. Which change is required to ensure interzone policy enforcement between the segments?

Accepted Answer

Assign each segment to a separate security zone so traffic between them is treated as interzone. To subject traffic between two internal segments to explicit policy and inspection, the segments must be placed in different zones. Interzone traffic is denied by default and requires an explicit allow rule, which is where security profiles and application restrictions can be applied. Keeping them in one zone leaves the traffic permitted by default.

Answer

Enable application inspection on the intrazone-default rule

Answer

Attach a Vulnerability Protection profile to the intrazone-default rule

Answer

Create a security policy rule with source and destination zones both set to the shared zone

Question 8

What happens when a security policy rule is set to 'Log at Session End'?

Accepted Answer

The log is generated only when the session terminates.. The log entry is generated only after the session has been closed, providing a summary of the total bytes and duration.

Answer

The log is generated at the start of the session only.

Answer

The log is triggered by a threat detection event.

Answer

The log is sent to the management plane every 10 seconds.

Question 9

A network security engineer is configuring a Palo Alto Networks firewall to enforce least-privilege access for a group of contractors. The contractors must be able to reach only an internal web application over HTTPS. The engineer wants to avoid creating a new security policy that allows any other application. Which Palo Alto Networks feature should the engineer use to identify and control the HTTPS application?

Accepted Answer

App-ID. App-ID is the Palo Alto Networks technology that identifies applications regardless of port, protocol, or encryption. By using App-ID in the security policy, the engineer can allow only the required HTTPS application and deny all others, achieving least privilege. User-ID, Content-ID, and decryption policy serve different purposes and do not directly identify and control applications for access enforcement.

Answer

Decryption policy

Answer

User-ID

Answer

Content-ID

Question 10

A network administrator is deploying a new Palo Alto Networks firewall in a data center. The security policy requires that all traffic to the DMZ be inspected for threats, but the administrator wants to ensure that SSL encrypted traffic is decrypted and inspected without breaking applications that use certificate pinning. Which feature should the administrator configure to selectively decrypt traffic based on the destination URL category?

Accepted Answer

SSL Forward Proxy with a Decryption Policy that includes URL categories. SSL Forward Proxy allows the firewall to act as a proxy for outbound SSL connections, decrypting traffic for inspection. By using a Decryption Policy, administrators can match on URL categories to selectively decrypt traffic, avoiding decryption for pinned applications. This provides threat inspection while maintaining application compatibility.

Answer

SSL Inbound Inspection with a decryption profile

Answer

SSH Proxy with a security policy rule

Answer

GlobalProtect with HIP profiles

Question 11

A NetSec-Pro administrator is using the Strata Cloud Manager API to automate the retrieval of security policy rule hit counts across multiple tenants. The API calls are failing with HTTP 403 errors. The administrator has verified that the API key is valid and has not expired. Which of the following is the most likely cause of the 403 errors?

Accepted Answer

The API key lacks the necessary role-based access control (RBAC) permissions to read policy rule hit counts.. A 403 Forbidden error with a valid API key points to insufficient permissions. In Strata Cloud Manager, RBAC roles determine what API operations are allowed. The administrator must ensure the API key's associated role includes read access to policy rule hit counts. Other causes like wrong HTTP method or tenant mismatch would produce different error codes.

Answer

The API endpoint requires a different HTTP method, such as POST instead of GET.

Answer

The API key is scoped to a different tenant than the one being queried.

Answer

The Strata Cloud Manager API requires mutual TLS authentication in addition to the API key.

Question 12

A security administrator is configuring a Security Policy rule to allow access to a sanctioned SaaS application. The administrator wants to ensure that the rule only allows the specific SaaS application and not other applications that might use the same underlying protocol. Which App-ID characteristic should be used to achieve this?

Accepted Answer

Application name. To allow only a specific SaaS application, the Security Policy rule must reference the exact application name. App-ID provides unique names for applications, enabling precise control. Other options like category or filters are too broad and could permit unintended applications. Therefore, specifying the application name is the only way to meet the requirement of allowing only the sanctioned SaaS application.

Answer

Application category

Answer

Application filter

Answer

Application dependency

Question 13

A network administrator is configuring a Security Policy rule to block traffic from a specific IP address. The administrator wants to ensure that the rule is evaluated before other rules that might allow the traffic. What should be configured to achieve this?

Accepted Answer

Move the rule to the top of the rulebase.. In a Security Policy rulebase, rules are processed from top to bottom, and the first match is enforced. To ensure a block rule takes effect before any allow rules, it must be placed at the top of the rulebase. Other options like logging or action settings do not influence evaluation order. Thus, moving the rule to the top is the correct configuration.

Answer

Add a negative source IP in the rule.

Answer

Set the rule to 'Deny' action.

Answer

Enable logging on the rule.

Question 14

A network security engineer is troubleshooting why a user cannot access a web application. The engineer checks the traffic logs and sees that the session is being denied by a security policy. The engineer suspects that the application is being identified incorrectly. Which tool should the engineer use to verify how the firewall is classifying the application in real time?

Accepted Answer

App-ID Test. The App-ID Test tool is designed to show how the firewall identifies applications based on session characteristics. By using it, the engineer can verify the App-ID for the specific traffic and determine if misclassification is causing the denial. This enables targeted troubleshooting.

Answer

Packet Capture

Answer

Session Browser

Answer

Application Command Center (ACC)

Question 15

A NetSec-Pro administrator needs to verify that a newly configured security policy on a Palo Alto Networks firewall is correctly logging traffic to an external syslog server. The administrator has already configured the Log Forwarding profile and syslog server. Which tool in the firewall's web interface should the administrator use to view real-time logs and confirm that they are being forwarded?

Accepted Answer

Monitor > Logs > Traffic. To verify that traffic logs are being generated and forwarded, the administrator should check the Monitor > Logs > Traffic page. This page shows real-time traffic logs. If logs appear there and the Log Forwarding profile is correctly configured, they will be forwarded to the syslog server. Other log types or analytical views do not serve this purpose.

Answer

Monitor > App Scope > Traffic

Answer

Monitor > Logs > System

Answer

Monitor > Logs > Threat