NetSec-Pro Practice Test 4 — 25 Questions

Question 1

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security policy is configured with the action 'Allow' but the profile setting is set to 'None'.. Security profiles are applied to traffic only if they are attached to the matching security policy rule. In the rule's Actions tab, the Profile Setting must be configured with a Security Profile Group or individual profiles. If it is left as 'None', the firewall allows the traffic but does not inspect it with any profiles. This is a common oversight when creating new rules.

Answer

The security policy is configured with a source and destination zone that do not match the traffic.

Answer

The security policy is using the 'Application Default' action instead of 'Allow'.

Answer

The security policy is set to 'Allow' but the 'Log at Session End' is disabled, which also disables security profile inspection.

Question 2

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

Accepted Answer

GlobalProtect App. The GlobalProtect App (B) is the endpoint client installed on mobile users' laptops and devices; it initiates the tunnel and enforces security policy on the endpoint, making it a core component of Prisma Access mobile user protection. The GlobalProtect Gateway (D) is the Prisma Access service infrastructure that terminates the GlobalProtect tunnels from mobile users and applies security policy in the cloud. The Identity Provider (E), using SAML or LDAP, is required to authenticate mobile users and enable identity-based policy enforcement before access is granted. Service Connection (A) is used to connect remote networks and data centers to Prisma Access, not mobile users, and a Local Branch Firewall (C) is a remote network component rather than part of the mobile user architecture.

Answer

Service Connection

Answer

Local Branch Firewall

Question 3

When using App-ID, what happens if traffic matches a policy allowing 'web-browsing' but the application is actually 'facebook-base'?

Accepted Answer

The traffic is dropped because it does not match the allowed application.. App-ID identifies the actual application, not just the port or protocol. If a policy allows 'web-browsing' but the traffic is identified as 'facebook-base', it does not match the allowed application. By default, the firewall denies traffic that does not match any rule, so the traffic is dropped. This enforces application-level control.

Answer

The traffic is allowed because Facebook uses HTTP.

Answer

The firewall allows it but flags the log as 'unknown'.

Answer

The firewall automatically updates the policy.

Question 4

Which action should be taken after performing a firmware upgrade on a Palo Alto Networks firewall to ensure all components are up to date?

Accepted Answer

Install the latest Dynamic Updates for App-ID and Threats.. After a firmware upgrade, the firewall's App-ID and Threat signatures may be outdated. Installing the latest Dynamic Updates ensures that the firewall has the most current application signatures and threat prevention capabilities, which are separate from the firmware itself.

Answer

Immediately reboot the device again.

Answer

Re-import the entire configuration XML file.

Answer

Factory reset the device.

Question 5

When configuring an interface for DHCP client, where do you set the default gateway?

Accepted Answer

The gateway is learned via the DHCP server response.. When an interface is configured as a DHCP client, the default gateway is not manually configured anywhere in the GUI — it is learned dynamically from the DHCP server's response (specifically the router option, DHCP option 3). The firewall installs this gateway into its virtual router's routing table automatically, so no static route or manual gateway entry is required. This is why the correct answer is that the gateway is learned via the DHCP server response.

Answer

Network > Interfaces > Advanced

Answer

Device > Setup > Services

Answer

Network > Virtual Router > Static Routes

Question 6

A security administrator is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. They have enabled SSL Forward Proxy decryption on a security policy rule. However, users report that they are unable to access certain banking websites, and the firewall logs show decryption errors. Which action should the administrator take to resolve this issue while maintaining security?

Accepted Answer

Add the banking websites to the SSL Decryption Exclusion list.. SSL Decryption Exclusion is designed for sites that break when decrypted, such as those using certificate pinning. Banking websites commonly employ certificate pinning, causing clients to reject the firewall's certificate. Adding these sites to the exclusion list allows them to bypass decryption, restoring access while still decrypting and inspecting other traffic. Disabling decryption entirely or changing certificates/ciphers does not solve the specific compatibility issue.

Answer

Import the banking websites' certificates into the firewall's trust store.

Answer

Configure the firewall to use a different cipher suite for decryption.

Answer

Disable SSL Forward Proxy decryption entirely on the firewall.

Question 7

A security operations team is using the NetSec-Pro 'Policy Optimizer' to review rule usage. They notice that a rule allowing 'any' application on port 80 has a high session count but no application identification. They want to safely transition this rule to a more secure, application-based rule. Which action should they take first according to best practices?

Accepted Answer

Use the Policy Optimizer's 'App Usage' view to identify which applications are traversing the rule, then create a new rule with those applications.. Policy Optimizer's 'App Usage' view provides visibility into which applications are actually using a permissive rule. By analyzing this data, the administrator can create a new rule that allows only those specific applications, thus tightening security without guessing. This is a safe, data-driven approach recommended by best practices.

Answer

Clone the rule and set the clone to 'allow' with application 'any', then gradually phase out the original rule.

Answer

Enable 'Application' in the security policy and remove the 'any' application setting, then commit.

Answer

Change the rule's action to 'deny' and monitor logs for any blocked traffic to identify applications.

Question 8

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

Accepted Answer

Enable 'Sinkhole' and specify the IP address for the sinkhole.. Option A is correct because enabling the Sinkhole action in a DNS Security profile lets the firewall return a forged, administrator-specified IP address (the sinkhole IP) for DNS queries that match malicious domains, preventing clients from reaching malware command-and-control or payload servers. Option C is correct because the DNS Categories tab is where you select which URL/domain categories (e.g., malware, phishing, command-and-control) the profile should block or sinkhole, which is the core mechanism for filtering DNS-based threats. The other options do not belong: DNS over HTTPS (B) is a client-side encrypted transport that the firewall cannot simply 'force' via a DNS Security profile, a DNS Proxy object per zone (D) is not required for a DNS Security profile to function, and Packet Capture (E) is a troubleshooting/diagnostic feature, not a protection setting.

Answer

Configure 'DNS over HTTPS' to force all traffic through the firewall.

Answer

Create a 'DNS Proxy' object for every zone.

Answer

Enable 'Packet Capture' for all DNS traffic.

Question 9

An administrator managing 200 Palo Alto Networks firewalls with Strata Cloud Manager needs to rapidly deploy a new decryption policy only to firewalls in the European branch offices, which are identified by the region tag 'EU'. The administrator wants to avoid manual per-firewall configuration and ensure the policy is applied consistently. Which SCM feature should the administrator use?

Accepted Answer

Use a dynamic device group with a tag-based membership criterion filtering on 'EU'.. Dynamic device groups in Strata Cloud Manager allow policies to be applied based on tags, enabling automatic inclusion of firewalls matching the 'EU' region tag. This eliminates manual configuration, ensures consistency, and scales efficiently. Static groups require manual updates, source zones are not geographic, and Panorama template stacks address device settings rather than dynamic policy targeting.

Answer

Define a policy rule with a source zone of 'EU' and apply it globally.

Answer

Use a Panorama template stack with region-based variables.

Answer

Create a static device group and manually add each European firewall.

Question 10

An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?

Accepted Answer

Source NAT. Source NAT (SNAT) is correct because it translates the source IP address of outbound packets to a public IP address, allowing internal users with private IPs to access the internet while hiding their private addresses. This is the standard NAT type used for masquerading internal networks behind a single public IP or pool. It is typically implemented on the egress interface of a router or firewall, and is also known as IP masquerading or NAT overload (PAT).

Answer

Static NAT

Answer

Double NAT

Answer

Destination NAT

Question 11

Which THREE features are part of the Palo Alto Networks Single Pass Architecture?

Accepted Answer

App-ID. The Palo Alto Networks Single Pass Architecture performs all security processing in one pass through the dataplane, and its three core identifying technologies are App-ID, User-ID, and Content-ID. Option C (App-ID) is correct because it identifies the application regardless of port, protocol, or encryption, which is the foundation of the single-pass inspection. Option D (User-ID) is correct because it maps IP addresses to users and groups so policy can be enforced based on identity, feeding directly into the same single-pass evaluation. Option E (Content-ID) is correct because it applies threat prevention, URL filtering, file blocking, and data filtering to the identified flow within that same pass. Options A (Management interface) and B (Switching capacity) are not correct because they are platform/hardware characteristics rather than the security technologies that constitute the Single Pass Architecture.

Answer

Management interface

Answer

Switching capacity

Question 12

A network security engineer is troubleshooting a Security policy rule that is supposed to block traffic to a known malicious IP address. The rule is configured with the action 'deny' and is placed at the top of the rulebase. However, traffic to that IP is still being allowed. What is the most likely cause?

Accepted Answer

The malicious IP address is not correctly defined in the address object used in the rule.. The most likely cause is that the malicious IP address is not correctly defined in the address object used in the rule. If the address object is incorrect, the rule will not match traffic to that IP, and subsequent rules may allow it. Rule order and action are correct, and source zone 'any' does not prevent matching. Therefore, checking the address object is essential.

Answer

The rule is not matching because the source zone is set to 'any'.

Answer

The rule is being overridden by a more specific rule below it.

Answer

The rule action 'deny' is not supported; the correct action is 'drop'.

Question 13

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Accepted Answer

Vulnerability Protection. Vulnerability Protection is the security profile specifically designed to detect and block known exploit patterns, such as buffer overflows, SQL injection, and cross-site scripting, while allowing the traffic if it is not malicious. It inspects traffic for signatures of known vulnerabilities and can be configured to block or alert. For a web server, this profile is essential to protect against application-layer attacks.

Answer

Anti-Spyware

Answer

URL Filtering

Answer

File Blocking

Question 14

A network administrator is configuring a NetSec-Pro firewall to send alerts to an external email server when a critical threat is detected. They navigate to the 'Log Settings' under the 'Device' tab and configure the email server profile. Which additional step is required to ensure that threat logs trigger email notifications?

Accepted Answer

Create a log forwarding profile that includes email as a destination and attach it to the security policy.. To send email alerts for critical threats, the administrator must create a log forwarding profile that specifies email as a destination and apply it to the security policy. The email server profile provides the server details, but the log forwarding profile is what actually triggers the email based on matching logs.

Answer

Set the 'Log Severity' for threat logs to 'critical' in the global log settings.

Answer

Configure a syslog server profile and set the email server as the syslog destination.

Answer

Enable 'Email Notifications' in the 'Threat Prevention' profile settings.

Question 15

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

Accepted Answer

The Template Stack order is incorrectly configured, causing overlapping values.. A template conflict usually occurs when a setting is defined in both the Device-level configuration and the Panorama Template stack without proper stack ordering.

Answer

The Panorama license has expired.

Answer

The firewall is in maintenance mode.

Answer

The device group is locked by another administrator.

Question 16

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Accepted Answer

Upload the firmware images to Panorama.. Option B is correct because Panorama must have the target PAN-OS firmware images uploaded to it (via Device > Software or the Panorama software manager) so they can be pushed to managed firewalls during a large-scale upgrade. Option C is correct because the Compatibility Matrix must be verified to confirm that each firewall model supports the target PAN-OS release and that the required base image and upgrade path are valid before deploying enterprise-wide. Option A is wrong because deleting logs does not prepare firmware images or validate upgrade paths and could destroy audit data. Option D is wrong because disabling security policies is unnecessary and would create a security gap during the upgrade. Option E is wrong because manually SSHing into every firewall is not scalable or required; Panorama can check and report disk space and readiness across managed devices.

Answer

Delete all old logs to free up space.

Answer

Disable all security policies.

Answer

Manually SSH into every firewall to check disk space.

Question 17

An administrator is configuring a SASE solution with Palo Alto Networks Prisma Access. The goal is to ensure that traffic from remote users to SaaS applications is inspected for threats while optimizing performance. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Prisma Access security processing node (SPN) in the closest region. To secure remote user traffic to SaaS applications with Prisma Access, a GlobalProtect app on user devices establishes the connection, and a Security Processing Node (SPN) in the closest region performs security inspection and optimizes routing. These two components are essential for SASE security and performance.

Answer

A dedicated VPN concentrator in the data center

Answer

Explicit proxy configuration on the remote user's device

Answer

SD-WAN devices at branch offices

Question 18

An administrator is using the Palo Alto Networks Expedition tool to migrate a configuration from a competitor firewall to a Palo Alto Networks firewall. After importing the competitor's configuration, the administrator notices that some rules are not being translated correctly. Which step should the administrator take to improve the translation accuracy?

Accepted Answer

Use the Expedition migration tool's built-in parser and adjust the translation settings.. Expedition is a free tool from Palo Alto Networks designed to help migrate configurations from other vendors. It uses parsers to translate rules, objects, and policies. If translations are incorrect, the administrator can adjust the translation settings, such as mapping services and applications, or use the tool's built-in validation and suggestion features. This iterative process improves accuracy. Manually rewriting rules or using unsupported methods is not recommended.

Answer

Export the configuration to a CSV file and import it into Panorama.

Answer

Disable rule translation and rely on manual entry.

Answer

Manually rewrite all rules from scratch.

Question 19

A network security administrator is using the Palo Alto Networks Best Practice Assessment (BPA) tool to evaluate the security posture of a firewall. The BPA report shows a low score in the 'Security Policy' category due to overly permissive rules. Which action should the administrator take to improve the score while maintaining necessary access?

Accepted Answer

Replace 'any' applications with specific applications and narrow the source and destination addresses.. The Best Practice Assessment (BPA) tool evaluates firewall configurations against Palo Alto Networks best practices. A low score in 'Security Policy' often indicates overly permissive rules, such as those using 'any' application or broad source/destination. To improve the score, the administrator should replace 'any' with specific applications and narrow addresses to only what is necessary. This maintains required access while making the policy more secure and aligned with best practices.

Answer

Create a new rule to deny all traffic and place it at the top.

Answer

Disable logging on the permissive rules to reduce log volume.

Answer

Enable all security profiles on the permissive rules.

Question 20

A network administrator is troubleshooting a Palo Alto Networks firewall and needs to verify which security policy rule is allowing or denying a specific session. The administrator wants to see the rule name and the action taken for a particular flow. Which CLI command should be used?

Accepted Answer

test security-policy-match application web-browsing source 10.1.1.1 destination 10.2.2.2 destination-port 80 protocol 6. The 'test security-policy-match' command is specifically designed to simulate a policy lookup and show which security policy rule matches a given set of flow parameters. It returns the rule name and the action, making it ideal for troubleshooting why traffic is allowed or denied. Other commands either show session details without the rule or display the entire policy without evaluating a specific flow.

Answer

show session all filter source 10.1.1.1 destination 10.2.2.2

Answer

show running security-policy

Answer

debug dataplane policy