NetSec-Pro Practice Test 5 — 25 Questions

Question 1

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

Accepted Answer

Panorama. Panorama is the primary tool for centralized management, visibility, and logging (when used with Panorama Logging).

Answer

Cortex XDR

Answer

Threat Vault

Answer

Customer Support Portal

Question 2

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Accepted Answer

Push the configuration to the new device using the existing Device Group.. Replacing a hardware unit requires adopting the existing configuration and assigning the new serial number to the existing device entry.

Answer

Re-license every feature manually.

Answer

Create a new Device Group for the replacement.

Answer

Reset the firewall to factory defaults.

Question 3

Which THREE items are included in a Panorama configuration 'Export'?

Accepted Answer

Security policy rules. A Panorama configuration export typically includes the full XML policy set, device group structure, and object definitions.

Answer

Log data files

Answer

Historical threat reports

Question 4

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Accepted Answer

Upload the firmware images to Panorama.. Preparation involves verifying hardware compatibility and ensuring the images are pre-loaded on the Panorama server.

Answer

Delete all old logs to free up space.

Answer

Disable all security policies.

Answer

Manually SSH into every firewall to check disk space.

Question 5

You are managing firewalls across multiple time zones using Panorama. Where do you configure the time zone for the managed firewalls?

Accepted Answer

In a Panorama Template.. Time zone settings are part of the Device configuration, which is managed via Panorama Templates.

Answer

In the global system settings of Panorama.

Answer

In the Device Group settings.

Answer

In the log forwarding profile.

Question 6

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Accepted Answer

Automatic updates and feature availability.. SCM provides cloud-native benefits such as reduced infrastructure overhead and automated updates.

Answer

Direct root access to the management server.

Answer

Support for legacy PAN-OS versions 6.0 and below.

Answer

Ability to host custom local scripts.

Question 7

Which SCM feature allows you to view the health status of your entire global firewall deployment?

Accepted Answer

Dashboard. The SCM 'Dashboard' provides a high-level overview, including device health and connectivity status.

Answer

Report Generator

Answer

Device Inventory

Answer

Policy Monitor

Question 8

Which THREE types of information are contained in the Panorama 'Device Health' report?

Accepted Answer

CPU utilization. Device health reports track resource utilization and system status, essential for enterprise monitoring.

Answer

Security policy hit counts

Answer

Active user count

Question 9

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

Accepted Answer

Upload images to Panorama and use the 'Software' tab to push them to devices.. Uploading images to the Panorama server first allows for consistent deployment to all managed firewalls.

Answer

Use the 'Auto-Update' feature on firewalls only.

Answer

Download images directly on each firewall.

Answer

Use an external TFTP server for all devices.

Question 10

Which THREE components are critical to ensure that Panorama can successfully manage a firewall behind a NAT/Firewall?

Accepted Answer

A valid auth key/token for the device.. Connectivity requires a valid management connection, appropriate port access, and correct authentication credentials.

Answer

A static public IP for the firewall.

Answer

SNMP community string configured.

Question 11

Which object type allows you to group multiple IP addresses into a single entity for use in security policies?

Accepted Answer

Address Group. An Address Group object allows you to aggregate individual address objects for simplified policy management.

Answer

Service Object

Answer

Application Group

Answer

Region Object

Question 12

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

Accepted Answer

Assign the tunnel interface to a security zone.. Both IKE Phase 1 and Phase 2 crypto profiles must be configured correctly, and the tunnel interface must be assigned to a zone.

Answer

Disable all logging on the tunnel interface.

Answer

Enable DHCP on the tunnel interface.

Answer

Configure the tunnel as an L2 bridge.

Question 13

A user is blocked by a URL Filtering profile. Where can you find the specific log entry that explains why the block occurred?

Accepted Answer

Monitor > Logs > URL Filtering. The URL Filtering logs contain the specific reason and the category that triggered the block.

Answer

Monitor > Logs > WildFire Submissions

Answer

Monitor > Logs > Traffic

Answer

Monitor > Logs > Threat

Question 14

What is the result of having two security policies with the same source, destination, and service, but different applications?

Accepted Answer

The first policy in the list that matches the traffic will be enforced.. Palo Alto Networks firewalls evaluate security policies from top to bottom. The first policy that matches the traffic criteria (including App-ID) will be applied.

Answer

The last rule in the list is always preferred.

Answer

The traffic is dropped by default.

Answer

The firewall merges the two policies.

Question 15

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

Accepted Answer

The security policy rules do not have an attached Security Profile Group.. Threat prevention logs are generated by policy rules; if a rule does not have a security profile attached, no logs are generated.

Answer

The 'Threats' dynamic update is not scheduled.

Answer

The firewall is in 'Evaluation Mode'.

Answer

The log forwarding profile is missing the 'Global' setting.

Question 16

When managing WildFire, how can you ensure that you are receiving the latest threat signatures as soon as they are generated?

Accepted Answer

Set the 'WildFire Update Schedule' to 'Every 1 minute'.. Setting the 'WildFire Update Schedule' to the most frequent interval (every minute) ensures near-instant signature delivery.

Answer

Enable 'Push Notifications' in the Device > Setup menu.

Answer

Use a local WildFire appliance in 'Synchronous' mode.

Answer

Force a manual 'Check Now' every hour.

Question 17

What is the primary difference between a 'Pre-rule' and a 'Post-rule' in a Panorama-managed environment?

Accepted Answer

Pre-rules are evaluated before local rules; Post-rules are evaluated after.. Pre-rules are evaluated before local rules, while Post-rules are evaluated after local rules.

Answer

Pre-rules are only for NAT.

Answer

Post-rules override Pre-rules.

Answer

Local rules can override Pre-rules.

Question 18

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

Accepted Answer

System logs. The system logs, specifically filtering for 'ssl-vpn' or management service traffic, help identify connection failures.

Answer

Configuration logs

Answer

Threat logs

Answer

Traffic logs

Question 19

Which THREE tasks are performed by the Dataplane during traffic processing?

Accepted Answer

Session lookup.. The dataplane is responsible for session lookup, security policy enforcement, and packet forwarding.

Answer

Management interface updates.

Answer

User-ID mapping updates.

Question 20

An administrator needs to restrict access to a specific website. Which profile should be modified?

Accepted Answer

URL Filtering. URL Filtering profiles are used to allow or block specific sites or categories.

Answer

Data Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection