NetSec-Pro Practice Test 5 — 10 Questions

Question 1

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

Accepted Answer

It detects and blocks the submission of enterprise credentials to untrusted or newly registered websites.. Credential Phishing prevention in Advanced URL Filtering detects when a user submits enterprise credentials to an untrusted or newly registered website, even if the site is not yet on a known-malicious URL list. It uses heuristics and site-reputation signals to identify credential submission to suspicious destinations and blocks it. This is behavior-based rather than purely signature-based.

Answer

It analyzes the URL to determine if it is a known malicious site.

Answer

It requires an agent installed on the endpoint to monitor browser activity.

Answer

It monitors all inbound traffic for known phishing signatures.

Question 2

A security administrator needs to allow the NetSec-Pro management plane to authenticate firewall administrators against the corporate Microsoft Active Directory. The AD servers are reachable only on the internal network. Which server profile type should the administrator configure on the firewall to meet this requirement?

Accepted Answer

LDAP server profile. To authenticate firewall administrators against Microsoft Active Directory, the management plane needs to query the directory for user and group objects. An LDAP server profile provides the server address, port, and bind credentials for that query, enabling role-based admin access. Kerberos, RADIUS, and TACACS+ profiles serve different authentication purposes and do not provide the directory browsing required for AD group mapping.

Answer

Kerberos server profile

Answer

TACACS+ server profile

Answer

RADIUS server profile

Question 3

A network administrator is troubleshooting a Prisma Access deployment where remote users are unable to access internal applications. The administrator suspects that the issue is related to the service connection configuration. Which component is responsible for routing traffic between Prisma Access and the corporate network?

Accepted Answer

Service connection. Service connections in Prisma Access are dedicated IPSec tunnels that connect the Prisma Access infrastructure to the corporate network, allowing remote users to reach internal applications. Remote networks are for branch connectivity, mobile user locations are compute locations, and explicit proxy is for web traffic forwarding. The service connection is the critical component for internal access.

Answer

Mobile user location

Answer

Remote network

Answer

Explicit proxy

Question 4

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

Accepted Answer

System Logs.. System Logs (A) are essential because they record control-plane and system-level events such as interface up/down transitions, routing or DHCP failures, and daemon errors that directly explain why a user's traffic cannot reach the internet. Traffic Logs (C) are essential because they show the actual session-level flow of the user's packets—source/destination, port, application, and allow/deny disposition—revealing whether traffic is being dropped, misrouted, or never leaving the device. Together these two logs cover both the underlying system state and the live traffic behavior needed to isolate an internet-connectivity failure. Decryption Logs (B) only matter for inspecting encrypted sessions and are irrelevant when basic connectivity is broken, Config Logs (D) merely track configuration changes rather than runtime connectivity state, and Threat Logs (E) only show security-policy hits such as exploits or malware, which are not required to diagnose a simple inability to reach the internet.

Answer

Decryption Logs.

Answer

Config Logs.

Answer

Threat Logs.

Question 5

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

Accepted Answer

It provides real-time, cloud-based analysis of unknown or newly registered domains.. Advanced URL Filtering adds real-time, cloud-based inline analysis of unknown or newly registered domains, using machine learning and threat intelligence to categorize and block malicious sites that signature-based URL filtering would miss. Standard URL filtering relies on a static, periodically updated database, so zero-day or newly registered malicious domains can slip through until the next update.

Answer

It allows the firewall to bypass SSL decryption for certain categories.

Answer

It includes an integrated VPN client for remote workers.

Answer

It allows for more custom URL categories.

Question 6

An administrator is configuring a NetSec-Pro firewall to prevent users from downloading executable files (.exe) from the internet. Which profile should be applied to the Security Policy rule to block this file type?

Accepted Answer

File Blocking profile. File Blocking profiles are used to block specific file types based on extension or magic bytes. To prevent .exe downloads, the administrator should configure a File Blocking profile with the executable file type set to block, and apply it to the Security Policy rule. Other profiles like Antivirus or Vulnerability Protection do not block by file type.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Antivirus profile

Question 7

A security operations analyst notices that a workstation in the trust zone is repeatedly attempting connections to an external IP address on TCP port 4444, a port commonly associated with remote access trojans. The security policy currently allows the workstation to reach any external destination on any port because of a legacy any-any outbound rule. The analyst wants to block this specific behavior without disrupting legitimate business traffic. Which action should the analyst take first?

Accepted Answer

Create a security policy rule above the legacy rule that denies the specific external IP address and port combination. Security policy rules are evaluated in order, so inserting a specific deny rule above the broad legacy allow rule stops the malicious flow before the permissive rule can match. This containment action addresses the immediate threat while preserving existing business connectivity, and it can be followed later by a broader policy cleanup.

Answer

Enable DNS sinkholing for the external IP address in the anti-spyware profile

Answer

Delete the legacy any-any outbound rule and replace it with a default deny rule

Answer

Add the external IP address to a URL Filtering profile applied to the workstation's outbound rule

Question 8

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Accepted Answer

The client sent a SYN packet but the server did not respond.. The 'incomplete' App-ID usually signifies that the TCP three-way handshake did not complete, or the application traffic ceased before it could be identified.

Answer

The Security Policy is missing a Decryption Profile.

Answer

The App-ID database is outdated.

Answer

The application is using a custom port not defined in the Service object.

Question 9

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

Accepted Answer

To redirect requests for malicious domains to a specific IP address to alert the administrator.. A DNS sinkhole works by intercepting DNS responses for domains that the security profile has flagged as malicious (based on threat signatures, PAN-DB/Advanced DNS categories, or DNS Security feeds). Instead of returning the real IP, the firewall rewrites the response to point to a sinkhole IP (typically 72.5.65.111 or a configured internal address). This blocks the connection and generates a log entry so the administrator can see which internal host attempted to reach the malicious domain.

Answer

To encrypt DNS traffic between the firewall and the ISP.

Answer

To allow a firewall to act as a DNS server for internal clients.

Answer

To cache DNS queries to improve network performance.

Question 10

A NetSec-Pro administrator is deploying a new branch office firewall. The security team requires that all traffic from the branch to the internet be inspected for threats, but they do not want to decrypt traffic due to privacy concerns. Which type of security profile should be applied to the outbound security policy to detect threats in unencrypted traffic without performing SSL decryption?

Accepted Answer

Vulnerability Protection profile. The Vulnerability Protection profile is specifically designed to detect and block exploits and malware in network traffic without requiring decryption. It inspects clear-text protocols and can be applied to security policies to enforce threat prevention. Since the branch office wants to inspect traffic for threats but not decrypt, this profile meets the requirement without compromising privacy.

Answer

File Blocking profile

Answer

SSL Decryption profile

Answer

Data Filtering profile