NetSec-Pro Practice Questions 2 — 50 Questions

Question 1

A network security engineer is configuring a Palo Alto Networks firewall to integrate with a SASE solution using GlobalProtect. The requirement is to ensure that traffic from remote users is inspected by the firewall's security profiles before being forwarded to the internet. The engineer has configured a GlobalProtect portal and gateway, and users can connect. However, traffic from remote users is not being inspected by security profiles. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The GlobalProtect gateway is not configured to route all client traffic through the tunnel (split tunnel is enabled).. For GlobalProtect to inspect all remote user traffic, the gateway must be configured to route all traffic through the tunnel. If split tunneling is enabled, internet-bound traffic bypasses the firewall. Security profiles on the policy rule are necessary but only effective if traffic traverses the firewall. Decryption and certificates are unrelated to the routing issue. Therefore, the missing configuration is the tunnel mode setting.

Answer

The GlobalProtect portal configuration does not include the correct client certificate for authentication.

Answer

The firewall's SSL decryption policy is not configured to decrypt traffic from GlobalProtect users.

Answer

The security policy rule allowing traffic from the GlobalProtect zone to the internet does not have security profiles attached.

Question 2

An administrator notices that the 'Commit' progress on Panorama hangs at 99%. What is the most effective way to troubleshoot this?

Accepted Answer

Check the 'Tasks' menu in Panorama for detailed error logs on the specific job.. The task manager in Panorama shows the status of ongoing jobs, and clicking on the job ID reveals detailed logs of the push process.

Answer

Reboot the Panorama appliance.

Answer

Clear the configuration cache on the firewall.

Answer

Increase the timeout value in Management Settings.

Question 3

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

Accepted Answer

Install the firewall's Forward Trust Certificate on all client devices.. For SSL Forward Proxy to inspect encrypted traffic, the firewall acts as a man-in-the-middle by presenting a certificate to the client that is signed by the firewall's Forward Trust Certificate. For the client to trust this certificate without errors, the Forward Trust Certificate (or its CA) must be installed in the client's trusted root store. Without this, clients will see certificate warnings and may block the connection, preventing inspection.

Answer

Enable SSH decryption on the management interface.

Answer

Configure a static IP address for the Decryption Broker.

Answer

Disable Certificate Revocation List (CRL) checks.

Question 4

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

Accepted Answer

WildFire. WildFire is Palo Alto Networks' cloud-based malware analysis and prevention service that inspects files using signatures, heuristics, and dynamic sandbox analysis. It detects unknown and zero-day threats by executing files in a virtual environment and observing behavior. WildFire verdicts are then shared globally to protect all subscribers.

Answer

URL Filtering

Answer

App-ID

Answer

User-ID

Question 5

You are configuring 'Log Forwarding' from Panorama to an external SIEM. Which object must you define in Panorama to facilitate this?

Accepted Answer

Log Forwarding Profile. Panorama log forwarding to an external SIEM is configured by attaching a Log Forwarding Profile to a log forwarding destination. The Log Forwarding Profile defines which log types are forwarded, the filter, and the target server (Syslog, SNMP, email, HTTP, etc.). Without this profile, Panorama has no rule set that tells it what to send and where.

Answer

Log Collector Profile

Answer

Reporting Profile

Answer

External Service Profile

Question 6

A network security administrator is configuring a Palo Alto Networks firewall to integrate with a directory service for user identification. They want to ensure that security policies can enforce rules based on user and group information. Which component must be configured to map IP addresses to user identities?

Accepted Answer

User-ID Agent. User-ID is the feature that maps IP addresses to user identities by collecting information from directory servers. The User-ID Agent (or integrated agent) performs this mapping, enabling security policies to use user and group as criteria. Other components like GlobalProtect, LDAP Server Profile, or Kerberos keytab support authentication or directory access but do not directly provide the IP-to-user mapping required for policy enforcement.

Answer

Kerberos Keytab

Answer

GlobalProtect Agent

Answer

LDAP Server Profile

Question 7

A network administrator is reviewing the TCP/IP model layers while troubleshooting a connectivity issue. The administrator needs to identify which layer is responsible for logical addressing and routing of packets across multiple networks. Which layer of the TCP/IP model performs this function?

Accepted Answer

Internet layer. In the TCP/IP model, the Internet layer is responsible for logical addressing and routing. It uses IP addresses to identify hosts and routers, and routing protocols to determine paths across networks. The Transport layer handles end-to-end connections, while the Network Access layer deals with local link delivery, and the Application layer supports user-facing protocols.

Answer

Transport layer

Answer

Application layer

Answer

Network Access layer

Question 8

An administrator needs to enable NetSec-Pro Clientless VPN for remote users. The portal is configured with a valid certificate and authentication profile. Users report that the portal loads, but no internal web applications are accessible. Which additional component must be configured to allow access to internal web applications?

Accepted Answer

Add the internal web applications to the Clientless VPN application list.. Clientless VPN requires a list of internal web applications to be defined so that the portal can present and proxy them. Without this list, users can authenticate and see the portal but cannot access any internal applications. The other options address traffic handling or inspection but do not populate the portal with applications.

Answer

Create a Security Policy rule allowing traffic from the untrust zone to the trust zone.

Answer

Configure an Application Override policy for the internal web servers.

Answer

Enable SSL decryption for the internal web servers.

Question 9

You have a security policy that allows 'any' application. What is the security risk of this configuration?

Accepted Answer

Increased risk of hidden threats using allowed ports.. Allowing 'any' application bypasses the granular control of App-ID, potentially allowing malicious traffic through common ports like 80/443.

Answer

The firewall will drop all traffic.

Answer

Performance overhead.

Answer

The firewall cannot log the traffic.

Question 10

Which SCM feature allows you to view the health status of your entire global firewall deployment?

Accepted Answer

Dashboard. The SCM 'Dashboard' provides a high-level overview, including device health and connectivity status.

Answer

Report Generator

Answer

Device Inventory

Answer

Policy Monitor

Question 11

Which THREE items are included in a Panorama configuration 'Export'?

Accepted Answer

Security policy rules. Option A (Security policy rules) is correct because Panorama's Export function saves the device-group policy configuration, including security rules, as part of the exported XML/configuration bundle. Option B (Template network configurations) is correct because template stacks and their network settings (interfaces, zones, virtual routers, etc.) are part of the Panorama configuration and are included in the export. Option E (Address and Service objects) is correct because these are configuration objects stored in Panorama and referenced by policy, so they are exported along with the rest of the config. Option C (Log data files) is not included because logs reside in the logging storage and are not part of a configuration export. Option D (Historical threat reports) is not included because reports are generated data/artifacts, not configuration, and are not part of the export.

Answer

Log data files

Answer

Historical threat reports

Question 12

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Accepted Answer

Automatic updates and feature availability.. SCM provides cloud-native benefits such as reduced infrastructure overhead and automated updates.

Answer

Direct root access to the management server.

Answer

Support for legacy PAN-OS versions 6.0 and below.

Answer

Ability to host custom local scripts.

Question 13

Which command is used to display the current User-ID mapping information on the CLI?

Accepted Answer

show user ip-user-mapping all. The command 'show user ip-user-mapping all' provides the current IP to username mapping table.

Answer

show logging user-id

Answer

test user-id

Answer

show system user-id

Question 14

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

Accepted Answer

Panorama. Panorama is the primary tool for centralized management, visibility, and logging (when used with Panorama Logging).

Answer

Cortex XDR

Answer

Threat Vault

Answer

Customer Support Portal

Question 15

Why should you use an App-ID 'Group' in a security policy?

Accepted Answer

To reduce policy rule count and simplify management.. App-ID groups simplify policy management by allowing you to update the group once rather than individual policies.

Answer

To force traffic over specific ports.

Answer

To enable SSL decryption for those applications.

Answer

To increase security by blocking unknown traffic.

Question 16

When configuring a zone, what is the primary security benefit of selecting 'Enable User Identification'?

Accepted Answer

It allows the firewall to map IP addresses to usernames for policy enforcement.. Enabling User Identification on a zone allows the firewall to map source IP addresses to usernames (via User-ID agents, terminal services agents, or captive portal) so that security policies can be written based on users or groups rather than just IP addresses. This provides identity-based policy enforcement, which is the primary security benefit of the feature.

Answer

It protects the zone from SYN flood attacks.

Answer

It forces all traffic in the zone to be decrypted.

Answer

It automatically enables log forwarding to Panorama.

Question 17

An administrator is using the Strata Cloud Manager API to programmatically create a security rule. The API request fails with a 400 Bad Request error. The administrator has verified that the authentication token is valid and the endpoint URL is correct. Which of the following is the most likely cause of the error?

Accepted Answer

The API request is missing a required HTTP header, such as 'Content-Type: application/json'.. A 400 Bad Request error in the SCM API usually indicates a malformed request. Common causes include missing required HTTP headers like 'Content-Type: application/json', invalid JSON syntax, or missing required fields. Since the token and URL are correct, the administrator should inspect the request headers and body for compliance with the API specification.

Answer

The API endpoint URL is incorrect and points to a non-existent resource.

Answer

The security rule name contains special characters that are not allowed.

Answer

The API token has expired and needs to be refreshed.

Question 18

A security administrator needs to configure a Palo Alto Networks firewall to send logs to an external syslog server. The logs should include traffic, threat, and URL filtering data. Which type of profile should be configured to forward these logs?

Accepted Answer

Log Forwarding Profile. A Log Forwarding Profile is used to specify which logs are forwarded to external syslog servers. It matches on log types and attributes and references server profiles that contain the syslog server details. This is the correct configuration object to meet the requirement.

Answer

Security Policy Rule

Answer

Syslog Profile

Answer

Server Profile

Question 19

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Accepted Answer

The application signature does not match the traffic's port or pattern.. When creating a custom application object, the signature must correctly match the traffic's port and pattern. If the signature does not match the actual traffic characteristics (e.g., wrong port, incorrect pattern matching, or missing context), the firewall will not identify the application as the custom App-ID, and the Security Policy referencing that App-ID will not match, resulting in a deny.

Answer

The application must be assigned to the 'web' category.

Answer

The App-ID must be added to a service group.

Answer

The application requires an SSL decryption policy first.

Question 20

What is the purpose of the 'Zone Protection Profile'?

Accepted Answer

To defend against reconnaissance and floods at the zone ingress.. Zone Protection Profiles are used to defend against reconnaissance (e.g., port scans) and flood attacks (e.g., SYN, UDP, ICMP floods) at the zone ingress. They are applied to zones and provide protection before traffic reaches security policies.

Answer

To enforce SSL decryption on traffic within the zone.

Answer

To protect the management plane from web attacks.

Answer

To map IP addresses to user identities.