NetSec-Pro Practice Questions 1 — 50 Questions

Question 1

Where do you configure a URL Filtering profile?

Accepted Answer

Objects > Security Profiles. URL Filtering profiles in Palo Alto Networks PAN-OS are configured under Objects > Security Profiles, alongside other security profiles like Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire Analysis. Once created there, the profile is applied to a Security policy rule. This location is consistent across PAN-OS versions and is where all reusable security profile objects live.

Answer

Policies > Security

Answer

Network > Profiles

Answer

Device > Setup

Question 2

A NetSec-Pro administrator is configuring a Security Policy rule to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the firewall identifies the application as web-browsing regardless of the port used. Which Security Policy rule component should be used to achieve this requirement?

Accepted Answer

Application. The Application field in a Security Policy rule leverages App-ID to classify traffic based on application signatures, not just ports. This allows the firewall to recognize web-browsing even on non-standard ports. The other fields (Service, Source Zone, Destination Address) are match criteria but do not provide application identification. Therefore, the Application field is the correct choice to meet the requirement.

Answer

Service

Answer

Destination Address

Answer

Source Zone

Question 3

A security operations team wants to receive alerts when the firewall detects a critical vulnerability exploit attempt. Which component should be configured to generate these alerts?

Accepted Answer

Vulnerability Protection profile. The Vulnerability Protection profile is specifically engineered to detect and prevent exploits that target software vulnerabilities. By configuring it to alert on critical severity events, the security team will receive notifications when such exploits are attempted. This profile inspects traffic for known exploit signatures and anomalies.

Answer

Antivirus profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 4

Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?

Accepted Answer

Commit Validation. The 'Commit Validation' or 'Pre-check' feature in SCM identifies potential issues before they are deployed.

Answer

Policy Optimizer

Answer

App-ID Dependency Check

Answer

Configuration Audit

Question 5

A network engineer is setting up a new Security Zone on a Palo Alto Networks firewall. The engineer wants to ensure that traffic entering this zone from any other zone is denied by default. Which action should be taken?

Accepted Answer

Ensure that no security policy rules exist that allow traffic to this zone from other zones.. Palo Alto Networks firewalls employ a default-deny security posture for inter-zone traffic. When a new zone is created, no traffic is allowed to or from it until a security policy rule explicitly permits it. Therefore, to ensure traffic entering the zone from other zones is denied, the engineer only needs to avoid creating allow rules. The default behavior takes care of the rest, making it a simple and secure starting point.

Answer

Create a security policy rule with source zone 'any' and destination zone 'any' with action 'deny'.

Answer

Set the zone's type to 'External' and enable 'Deny' in the zone properties.

Answer

Configure a Deny rule at the top of the security policy with source zone 'any' and destination zone 'any'.

Question 6

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

Accepted Answer

GlobalProtect app. The GlobalProtect app is necessary for remote users to connect and provide identity and posture information. Security policy rules with App-ID and User-ID are needed to enforce access control to SaaS applications based on user and application. Together, they enable threat inspection and identity-based control. The other options are either licensing, optional, or not applicable to mobile user connectivity.

Answer

Prisma Access service connection

Answer

Prisma Access mobile users license

Answer

Cloud Identity Engine

Question 7

A security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to block traffic and send a TCP reset to both the client and server. Which action should be selected?

Accepted Answer

Reset-Both. The Reset-Both action is designed to block traffic and send a TCP reset to both the client and the server. This immediately terminates the session on both ends. Deny sends a reset only to the client, Drop silently discards, and Reset-Client sends a reset only to the client. Therefore, Reset-Both is the correct action to meet the requirement of sending a TCP reset to both parties.

Answer

Drop

Answer

Deny

Answer

Reset-Client

Question 8

A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?

Accepted Answer

The security policy does not allow traffic from the VPN zone to the internal zone.. When a Site-to-Site VPN tunnel is up and routing is correct, the most common reason for traffic not passing is a missing or incorrect security policy. The firewall must have a policy allowing traffic from the VPN zone to the internal zone (and possibly the reverse). The default security policy denies all traffic, so without an explicit allow rule, packets are dropped. Administrators should check the security policy and ensure it matches the source and destination addresses and zones.

Answer

The tunnel interface is not assigned to a security zone.

Answer

The IKE gateway is configured with the wrong pre-shared key.

Answer

The IPsec proposal is misconfigured, causing the tunnel to flap.

Question 9

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

Accepted Answer

Network > Interface Management Profile. Management Profiles, applied to the physical interface, allow you to specify permitted IP addresses for administrative services.

Answer

Device > Administrators

Answer

Device > Setup > Session

Answer

Policies > Security

Question 10

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

Accepted Answer

Reset-Both informs the client and server that the connection is closed.. 'Drop' silently discards the packet, while 'Reset-Both' actively informs the sender and receiver that the connection is terminated.

Answer

Reset-Both is only for TCP, while Drop is only for UDP.

Answer

Drop is only available for inter-zone traffic.

Answer

Drop consumes more firewall CPU cycles.

Question 11

A security engineer is configuring GlobalProtect on a Palo Alto Networks firewall. The engineer wants to ensure that users are authenticated before they can access internal resources. The engineer has configured the GlobalProtect portal and gateway, but users are able to connect without providing credentials. What is the most likely cause?

Accepted Answer

The GlobalProtect gateway is configured with the authentication method 'none' in the agent configuration.. In GlobalProtect gateway configuration, the authentication method is set per agent configuration under Client Settings. If it is set to 'none', users are not required to authenticate. This is a common misconfiguration when testing or when the engineer forgets to set the authentication method. To enforce authentication, the method must be set to a valid option like LDAP, RADIUS, or client certificate.

Answer

The GlobalProtect portal is configured with the authentication method 'client certificate' only, and users have valid certificates installed.

Answer

The GlobalProtect gateway is configured with the authentication method 'pre-logon' and the pre-logon tunnel is being used.

Answer

The GlobalProtect portal is configured with the authentication method 'LDAP' but the LDAP server is unreachable.

Question 12

A network security administrator is configuring a firewall to integrate with a cloud-based threat intelligence service. The administrator wants to automatically block traffic to known malicious IP addresses and domains. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create an External Dynamic List (EDL) for IP addresses and domains.. To automatically block traffic to known malicious IPs and domains using a cloud-based threat intelligence service, you must first create External Dynamic Lists (EDLs) that contain the indicators. Then, you reference these EDLs in Security Policy rules to enforce blocking. This two-step process allows dynamic updates from the external source to be immediately enforced by the firewall.

Answer

Set up a DNS Security profile with a custom category for malicious domains.

Answer

Configure a Decryption policy to inspect SSL traffic to malicious sites.

Answer

Enable WildFire inline machine learning.

Question 13

What is the primary function of the 'Panorama' context in the Web UI of a managed firewall?

Accepted Answer

To view read-only policies and objects pushed from Panorama.. When a firewall is managed by Panorama, the 'Panorama' menu context allows you to view pushed policies and configuration objects.

Answer

To configure local security policies.

Answer

To change the Panorama server IP address.

Answer

To initiate a direct sync request to Panorama.

Question 14

An analyst is investigating why a server in the DMZ zone can reach an external update site on TCP 443 even though no security rule explicitly permits that server's traffic. The firewall uses a security rule with the application set to 'ssl' and the service set to 'application-default'. Which behaviour explains the observed connectivity?

Accepted Answer

The 'ssl' application inherently allows TCP 443, and 'application-default' resolves to that port, so the rule matches. The ssl application is tied to TCP 443, and setting the service to application-default makes the rule inherit that port from the application definition. The outbound session therefore matches the rule and is permitted, which is why the server reaches the update site without a port-specific rule.

Answer

The server is using a decryption profile that bypasses policy for trusted update sites

Answer

The firewall's content inspection engine automatically permits traffic to known software update repositories

Answer

The DMZ zone has an implicit rule that allows all outbound traffic to the Untrust zone

Question 15

Which THREE types of information are contained in the Panorama 'Device Health' report?

Accepted Answer

CPU utilization. The Panorama 'Device Health' report surfaces resource-level telemetry from managed firewalls, and it explicitly includes CPU utilization (A), disk space utilization (B), and memory usage (C) as its core metrics, since these three resource dimensions are what the report is designed to monitor for capacity and performance troubleshooting. CPU utilization (A) is correct because the report tracks processor load on the managed devices. Disk space utilization (B) is correct because the report shows storage consumption so administrators can detect low-disk conditions. Memory usage (C) is correct because the report monitors RAM consumption on the firewalls. Security policy hit counts (D) are not part of Device Health; that data appears in policy/rule usage and traffic logs, not the health report. Active user count (E) is also not included, as user/session information comes from other monitoring views such as the ACC or user activity logs rather than the Device Health report.

Answer

Security policy hit counts

Answer

Active user count

Question 16

A NetSec-Pro administrator is configuring a security policy to allow access to a web application. The administrator wants to ensure that the policy enforces least privilege by restricting access to only the necessary users and applications. Which two NetSec-Pro features should be used together to achieve this? (Choose two.)

Accepted Answer

App-ID. User-ID and App-ID together enable policies that allow only specific users to access only the required application. User-ID maps IP addresses to users, and App-ID identifies the application precisely. This combination enforces least privilege by ensuring that access is granted based on both user identity and application, rather than broad IP or port-based rules.

Answer

URL Filtering profile

Answer

Service objects

Answer

Security profile group

Question 17

Which feature allows the firewall to inspect encrypted traffic for threats?

Accepted Answer

SSL Decryption. SSL Decryption (also called SSL Forward Proxy) allows the firewall to decrypt outbound and inbound SSL/TLS traffic, inspect it for threats using security profiles, and then re-encrypt it before forwarding. Without decryption, encrypted traffic bypasses threat inspection, so SSL Decryption is the required feature to inspect encrypted traffic for threats.

Answer

Threat Prevention

Answer

App-ID

Answer

User-ID

Question 18

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

Accepted Answer

Verify the Security Policy to ensure traffic is allowed from the GlobalProtect zone to the internal zone.. When GlobalProtect authentication succeeds but the session is reset, the most likely cause is that the decrypted tunnel traffic is being denied by a Security Policy rule. The GlobalProtect zone (tunnel interface) must have an explicit allow rule to the internal/trust zone for the user's applications. Checking the Security Policy first confirms whether the reset is a policy drop rather than an authentication or client issue.

Answer

Check the client's OS version.

Answer

Check the authentication server status.

Answer

Restart the GlobalProtect service.

Question 19

What is the result of having two security policies with the same source, destination, and service, but different applications?

Accepted Answer

The first policy in the list that matches the traffic will be enforced.. When two security policies have the same source, destination, and service but different applications, the first policy in the list that matches the traffic will be enforced. Firewalls evaluate policies top-down and stop at the first match, so the order of policies is critical.

Answer

The last rule in the list is always preferred.

Answer

The traffic is dropped by default.

Answer

The firewall merges the two policies.

Question 20

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Accepted Answer

Push the configuration to the new device using the existing Device Group.. Option A is correct because Panorama manages firewalls through Device Groups, so once the replacement firewall is added and its serial number is registered, the existing Device Group configuration can be pushed to it, restoring the same policy and object configuration without rebuilding anything. Option D is correct because Panorama identifies managed firewalls by serial number, so the failed device's serial number must be removed (or the device deleted) and the replacement firewall's serial number added so Panorama can manage and push policy to the new hardware. Option B is incorrect because licensing is tied to the firewall's serial number and is handled through the support/licensing portal, not by manually re-licensing every feature as a Panorama replacement step. Option C is incorrect because creating a new Device Group is unnecessary and would fragment policy; the replacement should join the existing Device Group. Option E is incorrect because a new or replacement firewall does not require a factory reset as part of the Panorama replacement workflow.

Answer

Re-license every feature manually.

Answer

Create a new Device Group for the replacement.

Answer

Reset the firewall to factory defaults.