NetSec-Pro Practice Test 3 — 10 Questions

Question 1

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Accepted Answer

Network > GlobalProtect > Gateways > Client Settings. In Palo Alto Networks GlobalProtect, DHCP address assignment for clients is configured under Network > GlobalProtect > Gateways > [Gateway] > Client Settings, where the administrator specifies the IP pool and can select DHCP as the address assignment method. This is where the gateway tells connecting clients how to obtain their tunnel IP, so it is the correct location for this setting.

Answer

Objects > Addresses

Answer

Network > DHCP > Server

Answer

Device > Setup > Management

Question 2

Which of the following are types of Dynamic Updates? (Choose TWO)

Accepted Answer

Antivirus. In Palo Alto Networks PAN-OS, Dynamic Updates are the content and signature packages that the firewall downloads from the update server to keep its security engines current, and the two types asked for here are Antivirus (option B) and Applications and Threats (option C). Antivirus updates deliver the antivirus signature database used by the antivirus and WildFire security profiles to detect malware, so B is correct. Applications and Threats updates deliver the App-ID application signatures, threat signatures, and vulnerability protection content used by security policies, so C is correct. Firmware (A) is a PAN-OS software image upgrade rather than a Dynamic Update, External Dynamic Lists (D) are user-defined lists of IPs/domains/URLs imported for policy enforcement, and Certificate Revocation List (E) is a certificate-status mechanism, none of which are Dynamic Update types.

Answer

Firmware

Answer

External Dynamic Lists

Answer

Certificate Revocation List

Question 3

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

Accepted Answer

The PBF rule must be placed in the policy and reference a valid egress interface or next hop.. Policy-Based Forwarding (PBF) requires a rule that specifies a valid egress interface or next hop for matching traffic. Without a properly defined forwarding action (interface or next hop), the PBF rule cannot direct traffic, and it will not function. The rule must also be placed in the policy correctly and match the desired traffic.

Answer

The destination must always be an IP address object.

Answer

PBF must be enabled at the global configuration level.

Answer

PBF can only be used on Layer 2 interfaces.

Question 4

A security analyst is reviewing a packet capture and observes that a single TCP SYN packet sent to a closed port on an internal server elicits a TCP RST response, while the same SYN sent to a filtered port receives no response at all. Which statement best describes what the analyst is observing?

Accepted Answer

The RST means the port is closed, and the silent drop indicates the port is filtered by a device. In TCP scanning semantics, a RST reply to a SYN means the port is closed because the host is up but no listener exists. A complete absence of any reply indicates a filtering device dropped the packet, classifying the port as filtered. The combination of one closed and one filtered port confirms the host is online behind a filtering control.

Answer

The RST indicates the port is open and the service is accepting connections

Answer

Both responses indicate the ports are open but the services are misconfigured

Answer

The lack of response to the filtered port proves the host is offline

Question 5

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Accepted Answer

Performance metrics (latency, jitter, loss).. The SD-WAN policy uses Performance Probes to measure latency, jitter, and packet loss to select the best path.

Answer

Source IP address.

Answer

Static cost metrics.

Answer

Interface priority only.

Question 6

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Accepted Answer

The final verdict (e.g., Malware, Benign).. Option C is correct because the WildFire Analysis log records the final verdict returned by WildFire for the submitted sample, such as Malware, Benign, Grayware, or Phishing, which is the primary purpose of the log. Option E is correct because the WildFire Analysis log includes the MD5 hash (and typically SHA-256) of the analyzed file, which uniquely identifies the sample and is used to correlate submissions and verdicts. Options A, B, and D are not part of the WildFire Analysis log: username attribution, total bandwidth consumed by the transfer, and the physical port number used for upload are not fields WildFire reports, since the log focuses on file identification and the malware verdict rather than user or transport-layer details.

Answer

The username of the person who downloaded the file.

Answer

The total bandwidth used by the file transfer.

Answer

The physical port number used for the upload.

Question 7

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

Accepted Answer

Address Group. An Address Group in PAN-OS is a named object that contains multiple IP addresses, IP ranges, or subnets, and can also include other Address Groups. It is used in security policies to simplify management when the same set of addresses needs to be referenced in multiple rules. This directly matches the requirement to group multiple IP addresses.

Answer

Application Group

Answer

Tag

Answer

Service Group

Question 8

Which of the following is an example of a Security Profile?

Accepted Answer

Vulnerability Protection. Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering are all Security Profiles.

Answer

Policy Rule

Answer

Interface Configuration

Answer

Address Object

Question 9

An administrator wants to use User-ID. What is the primary benefit of mapping IP addresses to usernames?

Accepted Answer

To enable policy enforcement based on user or group membership.. User-ID allows security policies to be based on identities rather than IP addresses.

Answer

To increase firewall throughput.

Answer

To reduce the number of address objects.

Answer

To bypass the need for SSL decryption.

Question 10

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Accepted Answer

The session has not yet terminated.. By default, logs are generated when the session ends. If a session is very long, it may need a log interval configured to generate interim logs.

Answer

The 'Log at Session Start' option was not checked.

Answer

The log buffer is full.

Answer

The session is being decrypted.