NetSec-Pro Practice Test 3 — 30 Questions

Question 1

When configuring a virtual wire (VWire) interface, which setting is required to pass traffic between the two physical ports?

Accepted Answer

Create a Virtual Wire object linking two interfaces.. A VWire object must be created to link two physical interfaces together; without it, they are just isolated ports.

Answer

Enable 'DHCP Server' on the interface.

Answer

Assign an IP address to the VWire sub-interface.

Answer

Configure a zone with a 'Layer 3' type.

Question 2

What is the benefit of using an 'Aggregate Interface'?

Accepted Answer

It provides higher bandwidth and link redundancy.. Aggregate interfaces provide both increased bandwidth and link redundancy using LACP.

Answer

It allows the firewall to act as a layer 2 switch.

Answer

It enables hardware-level encryption.

Answer

It increases the number of available sub-interfaces.

Question 3

When a user connects via GlobalProtect, how does the firewall identify the user if they are not in the AD group?

Accepted Answer

It falls back to the IP-to-User mapping table.. The firewall can identify users via the GlobalProtect portal authentication logs or by falling back to the IP-to-User mapping.

Answer

It blocks the traffic by default.

Answer

It requests the MAC address.

Answer

It uses the machine name.

Question 4

Which TWO of the following are benefits of using App-ID over port-based security policies?

Accepted Answer

Prevents applications from bypassing security by using non-standard ports.. App-ID provides visibility into the actual application, regardless of the port, and allows for better security posture.

Answer

Requires no updates to the signature database.

Answer

Automatically creates security policies.

Answer

Increases throughput of the firewall.

Question 5

Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?

Accepted Answer

MFA Profile. Multi-Factor Authentication (MFA) profiles are integrated into the Authentication Policy to enforce secondary verification.

Answer

Authentication Portal

Answer

Credential Protection Profile

Answer

GlobalProtect Authentication Override

Question 6

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Accepted Answer

The session has not yet terminated.. By default, logs are generated when the session ends. If a session is very long, it may need a log interval configured to generate interim logs.

Answer

The 'Log at Session Start' option was not checked.

Answer

The log buffer is full.

Answer

The session is being decrypted.

Question 7

Which TWO of the following are valid ways to deploy GlobalProtect?

Accepted Answer

Split Tunnel VPN. GlobalProtect can be deployed as a full VPN or as a split-tunnel VPN, depending on the requirements.

Answer

Physical wire mode

Answer

Local Bridge Mode

Answer

Static VPN

Question 8

You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?

Accepted Answer

Device > Setup > Operations. Device > Setup > Operations allows you to configure 'Scheduled Configuration Export'.

Answer

Network > GlobalProtect

Answer

Objects > External Dynamic Lists

Answer

Device > Software

Question 9

An administrator needs to prevent a specific file type (e.g., .exe) from being downloaded. Which profile is used?

Accepted Answer

File Blocking Profile. File Blocking Profiles allow administrators to filter files by type and direction.

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 10

Which THREE of the following are settings that can be configured in a URL Filtering profile?

Accepted Answer

Category-based blocking. URL filtering profiles include categorization, allow/block lists, and credential phishing protection.

Answer

Antivirus scanning

Answer

File blocking

Question 11

Which type of interface is used to connect to a switch in a Layer 2 configuration where the firewall acts as a transparent bridge?

Accepted Answer

Layer 2 interface. Layer 2 interfaces are designed for transparent switching and do not require IP addresses for traffic processing.

Answer

Virtual Wire interface

Answer

Aggregate interface

Answer

Layer 3 interface

Question 12

Which action in a Security Policy rule will cause the firewall to send a TCP Reset to the client and server?

Accepted Answer

Reset-Both. The 'Reset-Both' action terminates the connection by sending a TCP Reset packet to both endpoints.

Answer

Drop

Answer

Allow

Answer

Deny

Question 13

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

Accepted Answer

Network > Interface Management Profile. Management Profiles, applied to the physical interface, allow you to specify permitted IP addresses for administrative services.

Answer

Device > Administrators

Answer

Device > Setup > Session

Answer

Policies > Security

Question 14

Which of the following are examples of Interface Management Profile services? (Choose TWO)

Accepted Answer

SSH. Management Profiles allow you to enable services like Ping, SSH, and HTTPS on an interface.

Answer

BGP

Answer

FTP

Answer

DHCP

Question 15

A company requires that traffic from the VPN zone to the Untrust zone undergoes source NAT using a specific interface IP. Which configuration step is mandatory to ensure this traffic is correctly matched?

Accepted Answer

Select the specific source zone and destination zone in the NAT rule.. The source NAT rule must explicitly match the source zone and destination zone of the traffic, along with the source interface if specified.

Answer

Disable 'Address Translation' in the NAT rule.

Answer

Enable 'Proxy ARP' on the egress interface.

Answer

Configure a policy-based forwarding rule instead of NAT.

Question 16

Which object type is used to group multiple IP addresses or subnets for use in a security policy?

Accepted Answer

Address Group. Address Objects can be grouped into an Address Group to simplify policy management.

Answer

Policy Group

Answer

Application Group

Answer

Service Group

Question 17

An administrator observes that dynamic updates for App-ID and Threat signatures are failing. Which troubleshooting step should be performed first?

Accepted Answer

Check the 'Device > Licenses' page to ensure the 'Threat Prevention' or 'PAN-DB' subscription is active.. The firewall requires a valid support license and connectivity to the Palo Alto Networks update servers (updates.paloaltonetworks.com).

Answer

Restart the management plane process using the 'debug software restart process management-plane' command.

Answer

Rebuild the configuration database using 'request system reset-config'.

Answer

Increase the timeout value in the 'Device > Setup > Management' tab.

Question 18

Which of the following are types of Dynamic Updates? (Choose TWO)

Accepted Answer

Antivirus. Dynamic Updates include content updates such as App-ID and Threat signatures.

Answer

Firmware

Answer

External Dynamic Lists

Answer

Certificate Revocation List

Question 19

Which of the following are valid methods for performing an initial configuration of a Palo Alto Networks NGFW? (Choose TWO)

Accepted Answer

Console port connection. Initial access is typically performed via the Console port (serial) or the Management interface (default IP).

Answer

Automatic Cloud provisioning via USB

Answer

SSH to the data plane interface

Answer

Bluetooth pairing

Question 20

Which three settings are part of a Zone Protection Profile? (Choose THREE)

Accepted Answer

Flood Protection. Zone Protection includes DoS protection, reconnaissance protection, and packet-based attack protection.

Answer

User-ID Mapping

Answer

Decryption Policy