NetSec-Pro Practice Test 2 — 30 Questions

Question 1

An administrator wants to ensure that only 'web-browsing' traffic is allowed on port 80. Which feature allows this enforcement?

Accepted Answer

App-ID. App-ID is the feature that identifies applications regardless of the port being used.

Answer

Zone Protection Profiles

Answer

Service Objects

Answer

Log Forwarding

Question 2

What does the 'Zone Protection Profile' protect against?

Accepted Answer

Denial of Service (DoS) and reconnaissance attacks.. Zone Protection profiles guard against flood attacks and reconnaissance at the zone level.

Answer

Unauthorized user access.

Answer

Malware downloads.

Answer

Application-specific exploits.

Question 3

What is the impact of selecting 'Action: Reset-Both' in a Threat Prevention profile for a detected vulnerability?

Accepted Answer

It sends a TCP RST to both the client and the server to terminate the connection.. Reset-Both terminates the TCP session from both the client and the server sides, immediately stopping the malicious traffic.

Answer

It triggers an alert but does not interfere with the traffic flow.

Answer

It blocks the source IP address for a specified duration.

Answer

It drops the packet but allows the TCP session to continue.

Question 4

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

Accepted Answer

Address Group. Address Groups allow grouping of address objects for efficient policy management.

Answer

Application Group

Answer

Tag

Answer

Service Group

Question 5

Which THREE of the following are consequences of enabling 'Log at Session End'?

Accepted Answer

Provides accurate session duration.. Logging at session end provides total byte counts, accurate duration, and comprehensive application details.

Answer

Forces the session to terminate.

Answer

Immediately notifies the administrator.

Question 6

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Accepted Answer

To query domain controllers for IP-to-User mapping.. The Agent monitors logs on domain controllers to map IP addresses to usernames in real-time.

Answer

To cache user credentials for SSO.

Answer

To encrypt traffic for GlobalProtect.

Answer

To push security policies to clients.

Question 7

Which action is required to ensure that WildFire analysis results are applied to traffic as quickly as possible?

Accepted Answer

Configure the WildFire profile to use the 'Real-time' analysis mode.. Enabling the 'Real-time' setting in the WildFire profile ensures files are sent and results are acted upon immediately.

Answer

Enable 'Packet Capture' for all security policies.

Answer

Increase the WildFire cloud region to the nearest geographic site.

Answer

Set the WildFire forwarding to 'Legacy' mode.

Question 8

Which feature allows you to block traffic based on a specific geographic region?

Accepted Answer

Policy-based filtering using 'Region' objects.. Geo-blocking is configured by using 'Region' objects in the Source or Destination fields of a Security Policy rule.

Answer

User-ID

Answer

DNS Security profile.

Answer

App-ID

Question 9

Which feature allows the firewall to inspect encrypted traffic for threats?

Accepted Answer

SSL Decryption. SSL Forward Proxy decryption allows the firewall to decrypt and inspect SSL traffic.

Answer

Threat Prevention

Answer

App-ID

Answer

User-ID

Question 10

Why should you use an App-ID 'Group' in a security policy?

Accepted Answer

To reduce policy rule count and simplify management.. App-ID groups simplify policy management by allowing you to update the group once rather than individual policies.

Answer

To force traffic over specific ports.

Answer

To enable SSL decryption for those applications.

Answer

To increase security by blocking unknown traffic.

Question 11

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

Accepted Answer

Ensure the 'Threats' dynamic update is downloaded and installed.. Threat prevention requires active signatures and the application of those signatures via policy profiles.

Answer

Disable 'App-ID' to prevent interference.

Answer

Manually restart the firewall after every update.

Answer

Enable SSL Decryption for all traffic.

Question 12

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

Accepted Answer

The dependent application, such as 'ssl', is not allowed in the policy.. If the App-ID is correct but traffic is denied, the dependent application (like ssl) might be missing.

Answer

The source zone is incorrect.

Answer

The firewall is in transparent mode.

Answer

The security profile is missing.

Question 13

Which of the following is an example of a Security Profile?

Accepted Answer

Vulnerability Protection. Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering are all Security Profiles.

Answer

Policy Rule

Answer

Interface Configuration

Answer

Address Object

Question 14

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

Accepted Answer

Captive Portal. User-ID can use the User-ID Agent to monitor logs or use the Captive Portal to directly authenticate users.

Answer

SNMP Traps

Answer

DNS Reverse Lookup

Answer

DHCP Relay

Question 15

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Accepted Answer

The client sent a SYN packet but the server did not respond.. The 'incomplete' App-ID usually signifies that the TCP three-way handshake did not complete, or the application traffic ceased before it could be identified.

Answer

The Security Policy is missing a Decryption Profile.

Answer

The App-ID database is outdated.

Answer

The application is using a custom port not defined in the Service object.

Question 16

An administrator wants to use User-ID. What is the primary benefit of mapping IP addresses to usernames?

Accepted Answer

To enable policy enforcement based on user or group membership.. User-ID allows security policies to be based on identities rather than IP addresses.

Answer

To increase firewall throughput.

Answer

To reduce the number of address objects.

Answer

To bypass the need for SSL decryption.

Question 17

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

Accepted Answer

Reset-Both informs the client and server that the connection is closed.. 'Drop' silently discards the packet, while 'Reset-Both' actively informs the sender and receiver that the connection is terminated.

Answer

Reset-Both is only for TCP, while Drop is only for UDP.

Answer

Drop is only available for inter-zone traffic.

Answer

Drop consumes more firewall CPU cycles.

Question 18

Which command is used to display the current User-ID mapping information on the CLI?

Accepted Answer

show user ip-user-mapping all. The command 'show user ip-user-mapping all' provides the current IP to username mapping table.

Answer

show logging user-id

Answer

test user-id

Answer

show system user-id

Question 19

Which component of the Palo Alto Networks architecture is responsible for the 'Single Pass' processing engine?

Accepted Answer

Data Plane. The Single Pass Parallel Processing (SP3) architecture integrates networking, security, and management on the dataplane.

Answer

Panorama

Answer

Management Plane

Answer

Control Plane

Question 20

You have a security policy that allows 'any' application. What is the security risk of this configuration?

Accepted Answer

Increased risk of hidden threats using allowed ports.. Allowing 'any' application bypasses the granular control of App-ID, potentially allowing malicious traffic through common ports like 80/443.

Answer

The firewall will drop all traffic.

Answer

Performance overhead.

Answer

The firewall cannot log the traffic.