NetSec-Pro Practice Test 2 — 25 Questions

Question 1

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

Accepted Answer

It provides real-time, cloud-based analysis of unknown or newly registered domains.. Advanced URL Filtering uses real-time analysis rather than just static database lookups to identify malicious sites.

Answer

It allows the firewall to bypass SSL decryption for certain categories.

Answer

It includes an integrated VPN client for remote workers.

Answer

It allows for more custom URL categories.

Question 2

Which TWO settings are configured within a GlobalProtect Gateway to manage user access?

Accepted Answer

Authentication profile.. Gateway settings define the authentication profile and the specific tunnel settings for the client.

Answer

Interface speed settings.

Answer

SNMP community strings.

Answer

Global NTP server configuration.

Question 3

Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?

Accepted Answer

Dynamic Updates.. Dynamic updates and external dynamic lists (EDLs) are the two primary ways to keep security intelligence current.

Answer

VLAN tagging.

Answer

Manual IP entry.

Answer

DHCP reservation.

Question 4

When managing infrastructure, what is the best practice for handling 'Security Profile Groups'?

Accepted Answer

Use a common group for similar traffic types to ensure consistent security policy enforcement.. Security Profile Groups allow for standardized enforcement across multiple rules, simplifying management and updates.

Answer

Only apply groups to traffic destined for the Internet.

Answer

Avoid using groups and always apply individual profiles to rules.

Answer

Create a unique group for every single security policy rule.

Question 5

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Accepted Answer

The final verdict (e.g., Malware, Benign).. The WildFire log provides details on the file hash and the analysis result.

Answer

The username of the person who downloaded the file.

Answer

The total bandwidth used by the file transfer.

Answer

The physical port number used for the upload.

Question 6

An administrator wants to ensure that only 'web-browsing' traffic is allowed on port 80. Which feature allows this enforcement?

Accepted Answer

App-ID. App-ID is the feature that identifies applications regardless of the port being used.

Answer

Zone Protection Profiles

Answer

Service Objects

Answer

Log Forwarding

Question 7

What does the 'Zone Protection Profile' protect against?

Accepted Answer

Denial of Service (DoS) and reconnaissance attacks.. Zone Protection profiles guard against flood attacks and reconnaissance at the zone level.

Answer

Unauthorized user access.

Answer

Malware downloads.

Answer

Application-specific exploits.

Question 8

What is the impact of selecting 'Action: Reset-Both' in a Threat Prevention profile for a detected vulnerability?

Accepted Answer

It sends a TCP RST to both the client and the server to terminate the connection.. Reset-Both terminates the TCP session from both the client and the server sides, immediately stopping the malicious traffic.

Answer

It triggers an alert but does not interfere with the traffic flow.

Answer

It blocks the source IP address for a specified duration.

Answer

It drops the packet but allows the TCP session to continue.

Question 9

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

Accepted Answer

Address Group. Address Groups allow grouping of address objects for efficient policy management.

Answer

Application Group

Answer

Tag

Answer

Service Group

Question 10

Which THREE of the following are consequences of enabling 'Log at Session End'?

Accepted Answer

Provides accurate session duration.. Logging at session end provides total byte counts, accurate duration, and comprehensive application details.

Answer

Forces the session to terminate.

Answer

Immediately notifies the administrator.

Question 11

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Accepted Answer

To query domain controllers for IP-to-User mapping.. The Agent monitors logs on domain controllers to map IP addresses to usernames in real-time.

Answer

To cache user credentials for SSO.

Answer

To encrypt traffic for GlobalProtect.

Answer

To push security policies to clients.

Question 12

Which action is required to ensure that WildFire analysis results are applied to traffic as quickly as possible?

Accepted Answer

Configure the WildFire profile to use the 'Real-time' analysis mode.. Enabling the 'Real-time' setting in the WildFire profile ensures files are sent and results are acted upon immediately.

Answer

Enable 'Packet Capture' for all security policies.

Answer

Increase the WildFire cloud region to the nearest geographic site.

Answer

Set the WildFire forwarding to 'Legacy' mode.

Question 13

Which feature allows you to block traffic based on a specific geographic region?

Accepted Answer

Policy-based filtering using 'Region' objects.. Geo-blocking is configured by using 'Region' objects in the Source or Destination fields of a Security Policy rule.

Answer

User-ID

Answer

DNS Security profile.

Answer

App-ID

Question 14

Which feature allows the firewall to inspect encrypted traffic for threats?

Accepted Answer

SSL Decryption. SSL Forward Proxy decryption allows the firewall to decrypt and inspect SSL traffic.

Answer

Threat Prevention

Answer

App-ID

Answer

User-ID

Question 15

Why should you use an App-ID 'Group' in a security policy?

Accepted Answer

To reduce policy rule count and simplify management.. App-ID groups simplify policy management by allowing you to update the group once rather than individual policies.

Answer

To force traffic over specific ports.

Answer

To enable SSL decryption for those applications.

Answer

To increase security by blocking unknown traffic.

Question 16

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

Accepted Answer

Ensure the 'Threats' dynamic update is downloaded and installed.. Threat prevention requires active signatures and the application of those signatures via policy profiles.

Answer

Disable 'App-ID' to prevent interference.

Answer

Manually restart the firewall after every update.

Answer

Enable SSL Decryption for all traffic.

Question 17

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

Accepted Answer

The dependent application, such as 'ssl', is not allowed in the policy.. If the App-ID is correct but traffic is denied, the dependent application (like ssl) might be missing.

Answer

The source zone is incorrect.

Answer

The firewall is in transparent mode.

Answer

The security profile is missing.

Question 18

Which of the following is an example of a Security Profile?

Accepted Answer

Vulnerability Protection. Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering are all Security Profiles.

Answer

Policy Rule

Answer

Interface Configuration

Answer

Address Object

Question 19

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

Accepted Answer

Captive Portal. User-ID can use the User-ID Agent to monitor logs or use the Captive Portal to directly authenticate users.

Answer

SNMP Traps

Answer

DNS Reverse Lookup

Answer

DHCP Relay

Question 20

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Accepted Answer

The client sent a SYN packet but the server did not respond.. The 'incomplete' App-ID usually signifies that the TCP three-way handshake did not complete, or the application traffic ceased before it could be identified.

Answer

The Security Policy is missing a Decryption Profile.

Answer

The App-ID database is outdated.

Answer

The application is using a custom port not defined in the Service object.