NetSec-Pro Practice Questions 1 — 50 Questions

Question 1

An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?

Accepted Answer

Create a security policy with a Source User-ID for the VPN user and a Destination Object for the server.. Using a combination of a dedicated security policy with a specific User-ID/Group-ID source and a specific destination address object is the standard practice for least privilege access.

Answer

Set the user to 'Any' in the security policy.

Answer

Create a NAT policy to map the user's IP to the server.

Answer

Assign the VPN user a unique IP pool.

Question 2

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?

Accepted Answer

Add a static route in the Virtual Router pointing to the remote subnet using the tunnel interface as the next hop.. To route traffic into a VPN tunnel, the tunnel interface must be associated with a Virtual Router and have a static or dynamic route pointing to the remote subnet with the tunnel interface as the next hop.

Answer

Configure the tunnel interface in a separate security zone.

Answer

Change the tunnel interface type to Layer 3.

Answer

Enable Proxy-ID settings on the tunnel interface.

Question 3

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Accepted Answer

test security-policy-match source destination protocol . The 'test security-policy-match' command allows the administrator to simulate a packet flow against existing security policies to see which one matches or if it is dropped.

Answer

debug dataplane packet-diag

Answer

show running security-policy

Answer

show session all filter source <ip>

Question 4

Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?

Accepted Answer

Enable Ping in the Interface Management Profile.. Link Monitoring or Interface Management profiles (specifically enabling ping) are used to verify connectivity to the ISP gateway.

Answer

Disable the interface.

Answer

Increase the ARP timeout value.

Answer

Change the interface speed to auto-negotiate.

Question 5

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

Accepted Answer

Verify the Security Policy to ensure traffic is allowed from the GlobalProtect zone to the internal zone.. If authentication passes but the session is reset, it is often due to a security policy dropping the traffic post-VPN or an MTU issue causing fragmentation and connection resets.

Answer

Check the client's OS version.

Answer

Check the authentication server status.

Answer

Restart the GlobalProtect service.

Question 6

Which THREE components are involved in configuring an IKE Gateway for a VPN?

Accepted Answer

Local interface.. An IKE Gateway requires the interface used for the connection, the peer IP, and a Pre-Shared Key or certificate for authentication.

Answer

VLAN ID.

Answer

DHCP server scope.

Question 7

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

Accepted Answer

It detects and blocks the submission of enterprise credentials to untrusted or newly registered websites.. Advanced URL Filtering inspects HTTP POST requests and uses URL categorization to detect and block credential theft.

Answer

It analyzes the URL to determine if it is a known malicious site.

Answer

It requires an agent installed on the endpoint to monitor browser activity.

Answer

It monitors all inbound traffic for known phishing signatures.

Question 8

You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?

Accepted Answer

Policy Test Tool (test security-policy-match). The Policy Optimizer and the Test Policy match tool are essential for identifying why traffic is being dropped or allowed.

Answer

Packet Capture (pcap)

Answer

GlobalProtect logs

Answer

Traffic Monitor

Question 9

Which plane on a Palo Alto Networks firewall is responsible for the web interface and CLI?

Accepted Answer

Management Plane. The Management Plane handles all management tasks, including the GUI and CLI.

Answer

Forwarding Plane

Answer

Security Plane

Answer

Data Plane

Question 10

Which TWO items can be used as match criteria in a Security Policy rule?

Accepted Answer

Source Zone. Policies can match based on Zones, Addresses, Applications, and Services.

Answer

Hardware Temperature

Answer

Management Plane Load

Answer

Interface Speed

Question 11

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

Accepted Answer

The custom application lacks a defined signature to identify the application flow.. When using custom applications, if the traffic does not match the signature or the default port is not defined correctly, the firewall marks it as incomplete.

Answer

The security policy has not been committed to the Data Plane.

Answer

Content-ID is disabled on the Security Policy rule.

Answer

User-ID is not enabled on the ingress interface.

Question 12

What is the purpose of a 'Security Profile Group'?

Accepted Answer

To combine multiple security profiles into a single object for easier policy assignment.. A Security Profile Group is a container that holds multiple types of security profiles (AV, URL, Threat, etc.) to be applied as a single unit.

Answer

To organize firewall administrators by department.

Answer

To collect all logs from a specific security zone.

Answer

To group firewall interfaces for load balancing.

Question 13

Which THREE of the following are valid Security Profile types?

Accepted Answer

URL Filtering. Anti-spyware, Vulnerability Protection, and URL Filtering are valid profiles.

Answer

Zone Routing

Answer

Policy Optimizer

Question 14

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

Accepted Answer

Captive Portal. Captive portal provides explicit authentication for users accessing specific web resources, ensuring positive identification.

Answer

IP-to-User Mapping via XML API

Answer

Clientless VPN

Answer

GlobalProtect Transparent Authentication

Question 15

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Accepted Answer

Vulnerability Protection. Vulnerability Protection profiles allow you to set actions like 'drop' or 'reset' for specific threat signatures.

Answer

Anti-Spyware

Answer

URL Filtering

Answer

File Blocking

Question 16

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Accepted Answer

Decrease the MTU size on the tunnel interface.. Adjusting the MSS (Maximum Segment Size) or MTU on the tunnel interface helps avoid fragmentation issues caused by VPN headers, which are a common cause of packet loss in tunnels.

Answer

Increase the GlobalProtect timeout value.

Answer

Disable hardware offloading for IPv6.

Answer

Enable IPv6 transition mechanisms on the external interface.

Question 17

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Accepted Answer

Network > GlobalProtect > Gateways > Client Settings. In the GlobalProtect Gateway configuration, under the Client Settings, the IP pool or the use of an external DHCP server can be defined.

Answer

Objects > Addresses

Answer

Network > DHCP > Server

Answer

Device > Setup > Management

Question 18

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

Accepted Answer

Add the site to the 'Allow List' in the URL Filtering profile object assigned to the security policy.. URL Filtering allows for category overrides within a profile to exempt specific sites from broad category-based blocking.

Answer

Move the security policy to the top of the policy list.

Answer

Add the site to the 'Blocked' list in the URL Filtering profile.

Answer

Create a new URL category and add the domain to it, then block that category.

Question 19

Where is the configuration located to enable the 'DNS Security' service on a specific security zone?

Accepted Answer

Policies > Security > [Rule Name] > Actions tab. DNS Security profiles are applied to security policy rules, which then process traffic from specific zones.

Answer

Objects > Security Profiles > DNS Security

Answer

Network > Zones > [Zone Name]

Answer

Device > Setup > Services > DNS

Question 20

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

Accepted Answer

System logs. System logs record infrastructure-level events, including BGP state changes and neighbor relationship transitions.

Answer

Traffic logs

Answer

Threat logs

Answer

Config logs