NetSec-Pro Practice Test 5 — 25 Questions

Question 1

Which THREE components are involved in configuring an IKE Gateway for a VPN?

Accepted Answer

Local interface.. An IKE Gateway configuration requires a Local interface (A), which specifies the physical or logical interface (e.g., ethernet1/1) on the firewall that terminates the VPN tunnel and sources IKE negotiations. It also requires a Peer IP address (C), the static IP of the remote IKE peer used to identify and reach the remote gateway during Phase 1 negotiation. A Pre-Shared Key (D) is also required as the authentication credential exchanged during IKE Phase 1 to authenticate both peers when using PSK-based authentication. VLAN ID (B) is a Layer 2 segmentation parameter not part of IKE gateway settings, and DHCP server scope (E) relates to address assignment for clients, not to IKE gateway configuration.

Answer

VLAN ID.

Answer

DHCP server scope.

Question 2

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Accepted Answer

It allows the packet based on the port-based match.. When a packet matches a Security Policy rule but the application has not yet been identified, the firewall allows the packet based on the port-based match. This is because application identification typically requires multiple packets to complete, so the firewall must permit the initial packets to flow to gather enough data for identification. The firewall then continues to monitor the session and may later enforce application-specific policies once the application is identified.

Answer

It drops the packet immediately.

Answer

It buffers the packet until identification is complete.

Answer

It rejects the packet and sends a TCP Reset.

Question 3

An administrator manages a Palo Alto Networks firewall and needs to ensure that the firewall can resolve domain names for its own services, such as for updating dynamic content and resolving FQDN objects in security policies. The administrator has configured DNS servers on the management interface. However, FQDN objects in security policies are not being resolved correctly. What is the most likely cause?

Accepted Answer

The DNS servers configured on the management interface are incorrect or unreachable, preventing FQDN resolution.. FQDN objects in security policies are resolved by the management plane using the DNS servers configured in Device > Setup > Services > DNS. If those servers are incorrect or unreachable, resolution fails. The management interface's DNS settings are used for this purpose, and dataplane DNS proxy is not required. Thus, checking the DNS server configuration and reachability is the correct troubleshooting step.

Answer

The firewall is configured to use the management interface for DNS resolution, but the FQDN objects require a DNS proxy configured on a dataplane interface.

Answer

The FQDN objects are not supported in security policies; only IP addresses can be used.

Answer

The DNS servers configured on the management interface are not reachable from the dataplane.

Question 4

An administrator needs to configure a Palo Alto Networks firewall to perform dynamic updates for applications and threats. The firewall has a valid support license and internet connectivity on the management interface. However, the administrator wants to schedule the updates to occur automatically at a specific time. Which configuration tab in the web interface should the administrator use to set up the update schedule?

Accepted Answer

Device > Dynamic Updates. Dynamic updates for applications and threats are scheduled in the Device > Dynamic Updates section of the web interface. This page allows administrators to set the update schedule, including frequency and time. Other tabs like Device > Setup > Services are for general services, Objects > Security Profiles for security profiles, and Network > Interfaces for interface configuration. Therefore, the correct tab is Device > Dynamic Updates.

Answer

Objects > Security Profiles

Answer

Network > Interfaces

Answer

Device > Setup > Services

Question 5

An administrator is configuring a Palo Alto Networks firewall to integrate with a SASE solution using Prisma Access. They need to ensure that traffic from branch offices is securely forwarded to Prisma Access for inspection. Which component should be configured on the branch office firewall to achieve this?

Accepted Answer

IPSec tunnel to Prisma Access service connection. To forward branch office traffic to Prisma Access for inspection, an IPSec tunnel must be configured from the branch firewall to a Prisma Access service connection. This tunnel securely transports traffic to Prisma Access, where security policies are applied. Other options like GlobalProtect portal, explicit proxy, or SD-WAN do not provide the required site-to-site secure forwarding for all branch traffic.

Answer

Explicit proxy configuration on the branch firewall

Answer

SD-WAN policy on the branch firewall

Answer

GlobalProtect portal on the branch firewall

Question 6

A NetSec-Pro administrator needs to ensure that the firewall can resolve domain names for its own management services and for DNS sinkholing. Which type of DNS configuration should be set up on the firewall?

Accepted Answer

DNS Client. The firewall must be configured as a DNS client to resolve domain names for its own management services and for DNS sinkholing. This is done by specifying DNS servers in the device settings. DNS Proxy and DNS Forwarding are for handling client DNS requests, not the firewall's own resolution. Therefore, the DNS Client configuration is required.

Answer

DNS Proxy

Answer

DNS Forwarding

Answer

DNS Server

Question 7

You need to ensure that the firewall logs identify traffic by the actual application name, even if the traffic is running on a non-standard port. Which mechanism makes this possible?

Accepted Answer

App-ID content inspection.. App-ID performs deep packet inspection and behavioral analysis to identify the actual application regardless of the port or protocol used. It goes beyond port-based identification by examining payload signatures, protocol behavior, and heuristics, so an application running on a non-standard port is still correctly identified and logged.

Answer

Service-based policy enforcement.

Answer

SSL Decryption.

Answer

Port-mapping configuration.

Question 8

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

Accepted Answer

System logs. System logs on the firewall capture management-plane events including SCM (Strata Cloud Manager) connectivity, management service status, and control-plane communication with cloud services. When troubleshooting the management connection between the firewall and SCM, the System log is the authoritative source because it records connection state changes, authentication events, and service errors for the management plane.

Answer

Configuration logs

Answer

Threat logs

Answer

Traffic logs

Question 9

A NetSec-Pro administrator is configuring a security policy to allow access to a critical internal application. The application uses a custom TCP port 8443 and requires that the firewall perform threat inspection. The administrator creates a rule allowing the application and attaches a Vulnerability Protection profile. However, users report that the application is not working. After checking the traffic logs, the administrator sees that the sessions are being denied by the 'intrazone-default' rule. What is the most likely cause?

Accepted Answer

The application is using a custom port that is not defined in the application object.. When an application uses a non-standard port, the firewall must be able to identify it as that application. If the application object does not include the custom port, the firewall will not recognize the traffic, and the security policy rule that specifies the application will not match. The traffic then falls through to the default rules, which may deny it. Properly defining the application with the custom port ensures the rule matches and the traffic is allowed and inspected.

Answer

The Vulnerability Protection profile is blocking the traffic.

Answer

The security policy rule is placed after the intrazone-default rule.

Answer

The security policy rule is configured with the wrong source zone.

Question 10

A NetSec-Pro administrator is configuring a Security Profile to block malicious files. The administrator wants to ensure that files are analyzed for zero-day exploits and that a verdict is returned to the firewall to block malicious files. Which Palo Alto Networks service should be enabled to achieve this?

Accepted Answer

WildFire. WildFire is specifically designed to analyze unknown files and return verdicts to the firewall, enabling blocking of zero-day exploits. The other options (URL Filtering, Antivirus, Anti-Spyware) provide complementary security functions but do not perform dynamic file analysis for zero-day threats. Enabling WildFire is the correct action to meet the administrator's requirement.

Answer

Antivirus

Answer

Anti-Spyware

Answer

URL Filtering

Question 11

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW. The engineer wants to allow traffic but generate an alert in the logs for auditing purposes. Which action should be selected in the Security Policy rule?

Accepted Answer

Alert. The Alert action is specifically designed to allow traffic while generating an alert in the logs. This is useful for auditing and monitoring without blocking legitimate traffic. The Allow action only logs without an alert, Deny and Drop block traffic, and Reset-Both (not listed) would also block. Therefore, Alert is the correct action to meet the requirement of allowing traffic and generating an alert.

Answer

Drop

Answer

Allow

Answer

Deny

Question 12

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

Accepted Answer

Ensure the 'Threats' dynamic update is downloaded and installed.. Option B is correct because Threat Prevention relies on the Applications and Threats content database, which is delivered through the 'Threats' dynamic update; without downloading and installing the latest content package, the firewall cannot recognize newly disclosed vulnerabilities and their signatures. Option E is correct because signatures alone do not act on traffic—a Vulnerability Protection profile (containing vulnerability signatures and actions) must be attached to the security policy rule so that matching traffic is inspected and blocked or alerted. Option A is wrong because App-ID is fundamental to identifying applications and is not disabled for Threat Prevention; disabling it would undermine policy enforcement rather than help. Option C is wrong because content updates do not require a manual reboot; the firewall applies new content dynamically. Option D is wrong because SSL decryption is only needed to inspect encrypted sessions and is not a general requirement for vulnerability protection of all traffic.

Answer

Disable 'App-ID' to prevent interference.

Answer

Manually restart the firewall after every update.

Answer

Enable SSL Decryption for all traffic.

Question 13

A security administrator is deploying Prisma Access for mobile users. The administrator wants to ensure that traffic from mobile users is inspected for threats and that access to certain applications is controlled based on user identity. Which component of Prisma Access is responsible for enforcing security policies and inspecting traffic?

Accepted Answer

Prisma Access security processing node. The Prisma Access security processing node is the component that enforces security policies and inspects traffic for threats. It applies Security Profiles and controls application access based on user identity. The GlobalProtect app is the client, the service connection links to the corporate network, and Cloud Identity Engine provides identity information, but none of these enforce policies or inspect traffic.

Answer

Prisma Access service connection

Answer

GlobalProtect app

Answer

Cloud Identity Engine

Question 14

A company is deploying Prisma Access for remote users. The security team wants to ensure that all traffic from remote users is inspected by the full security stack, including threat prevention and URL filtering, while also providing optimal performance for SaaS applications. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Security policy rules in Prisma Access with threat prevention and URL filtering profiles. The correct components are the GlobalProtect app configured with the Prisma Access portal and Security policy rules with threat prevention and URL filtering profiles. The GlobalProtect app connects remote users to Prisma Access, and the security policy rules ensure that traffic is inspected by the full security stack. Service connections and remote network configurations are for different use cases, and explicit proxy is not required when using GlobalProtect.

Answer

Remote network configuration for branch offices

Answer

Explicit proxy configuration for web traffic

Answer

Service connection configured for the corporate network

Question 15

A network security administrator is configuring a Security Policy rule to allow access to a specific SaaS application, but wants to block file uploads to that application. Which Palo Alto Networks feature should the administrator use to achieve this granular control?

Accepted Answer

SaaS Security API. SaaS Security API provides API-based integration with SaaS applications, enabling granular policy enforcement for activities like file uploads. It can allow access to the application while blocking specific actions, such as uploading files, based on user and data context. App-ID, URL Filtering, and DLP do not offer this level of activity control within SaaS applications.

Answer

URL Filtering

Answer

App-ID

Answer

Data Loss Prevention

Question 16

A security team is deploying Prisma Access for remote users and wants to ensure that traffic to sanctioned SaaS applications is inspected for data loss while traffic to unsanctioned SaaS is blocked. They also need to apply different inspection profiles based on user group. Which combination of Prisma Access and NGFW features should they use to meet these requirements?

Accepted Answer

Prisma Access with App-ID, SaaS tenant restrictions, and Security policy rules scoped by user group. The requirements are to inspect sanctioned SaaS for data loss, block unsanctioned SaaS, and apply different profiles by user group. Prisma Access with App-ID provides application identification, SaaS tenant restrictions control which tenants are reachable, and Security policy rules scoped to user groups allow different inspection profiles. This combination delivers the needed granularity and enforcement. URL categories, split tunneling, HIP profiles, and standalone File Blocking do not offer the same application-aware, group-based SaaS control.

Answer

Prisma Access with a custom URL category for each SaaS application and a single Security policy rule

Answer

GlobalProtect with split tunneling and a URL Filtering profile

Answer

GlobalProtect with HIP profiles and a File Blocking profile

Question 17

A network engineer is designing a zero-trust micro-segmentation architecture for an east-west data center. The requirement is to enforce security policy between workloads on the same VLAN without routing traffic through a physical firewall appliance. Which technology should the engineer implement?

Accepted Answer

Software-defined networking with a distributed virtual firewall. Micro-segmentation for east-west traffic without routing through a physical appliance is achieved with a distributed virtual firewall tied to SDN. This enforces policy at the workload's virtual interface, supports identity and application context, and centralizes management. The other choices either operate only at the access edge, lack centralized policy, or provide only static Layer 2 isolation.

Answer

Host-based firewall rules on each workload's operating system

Answer

802.1X port-based network access control on the data center switches

Answer

Private VLANs configured on the top-of-rack switches

Question 18

A security analyst is reviewing a packet capture and notices that a single TCP session to a web server is being inspected, logged, and policy-checked only once, even though the session carries thousands of packets. Which security architecture principle does this behavior illustrate?

Accepted Answer

Stateful inspection with session-based policy enforcement. The behavior described is session-based, stateful enforcement: the first packet creates a session, the policy is evaluated once, and subsequent packets are matched to that session. Stateless filtering would check every packet, while DPI and proxying describe inspection depth or connection handling rather than the single policy evaluation per session.

Answer

Stateless packet filtering with per-packet access control lists

Answer

Proxy-based inspection that terminates and re-originates each connection

Answer

Deep packet inspection that reassembles and scans every payload

Question 19

A network security team is designing segmentation for a new data center. They want to ensure that east-west traffic between application tiers is inspected and that any compromised host cannot freely reach other tiers. They plan to use security zones and security policies on their Palo Alto Networks firewalls. Which TWO design elements are required to enforce least-privilege east-west segmentation? (Choose two.)

Accepted Answer

Create explicit allow rules between tiers that specify only the required applications and services. Least-privilege east-west segmentation requires that traffic between tiers crosses a policy enforcement point and that only approved flows are allowed. Placing each tier in its own zone forces interzone evaluation, and explicit allow rules limited to required applications and services ensure that a compromised host cannot move laterally to unrelated tiers.

Answer

Enable a single any-any allow rule between all internal zones to simplify management

Answer

Rely on the default intrazone allow behavior to permit necessary tier communication

Answer

Configure all tiers to use the same subnet and VLAN to reduce routing complexity

Question 20

A network security engineer is troubleshooting an intermittent issue where some users lose access to an internal application after a firewall policy change. Logs show the traffic is being dropped with a session end reason indicating the application was not identified. The rule in question uses App-ID with a specific application, and the service is application-default. Which condition most likely explains the drop?

Accepted Answer

The application identification did not complete within the allowed number of packets, so the session was denied. App-ID requires enough packets to positively identify an application. When identification does not complete within the configured threshold, the firewall can deny the session, producing the unidentified-application drop reason. The intermittent pattern fits flows where identification timed out or was inconclusive.

Answer

The users are authenticating to the application with credentials that are not mapped by User-ID

Answer

The application is using a port that is not included in the application's default port list

Answer

The security rule's service was set to application-default, which disables App-ID inspection entirely