NetSec-Pro Practice Test 7 — 10 Questions

Question 1

Which THREE items are included in a Panorama configuration 'Export'?

Accepted Answer

Security policy rules. Option A (Security policy rules) is correct because Panorama's Export function saves the device-group policy configuration, including security rules, as part of the exported XML/configuration bundle. Option B (Template network configurations) is correct because template stacks and their network settings (interfaces, zones, virtual routers, etc.) are part of the Panorama configuration and are included in the export. Option E (Address and Service objects) is correct because these are configuration objects stored in Panorama and referenced by policy, so they are exported along with the rest of the config. Option C (Log data files) is not included because logs reside in the logging storage and are not part of a configuration export. Option D (Historical threat reports) is not included because reports are generated data/artifacts, not configuration, and are not part of the export.

Answer

Log data files

Answer

Historical threat reports

Question 2

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Accepted Answer

Automatic updates and feature availability.. SCM provides cloud-native benefits such as reduced infrastructure overhead and automated updates.

Answer

Direct root access to the management server.

Answer

Support for legacy PAN-OS versions 6.0 and below.

Answer

Ability to host custom local scripts.

Question 3

Which command is used to display the current User-ID mapping information on the CLI?

Accepted Answer

show user ip-user-mapping all. The command 'show user ip-user-mapping all' provides the current IP to username mapping table.

Answer

show logging user-id

Answer

test user-id

Answer

show system user-id

Question 4

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

Accepted Answer

Panorama. Panorama is the primary tool for centralized management, visibility, and logging (when used with Panorama Logging).

Answer

Cortex XDR

Answer

Threat Vault

Answer

Customer Support Portal

Question 5

Why should you use an App-ID 'Group' in a security policy?

Accepted Answer

To reduce policy rule count and simplify management.. App-ID groups simplify policy management by allowing you to update the group once rather than individual policies.

Answer

To force traffic over specific ports.

Answer

To enable SSL decryption for those applications.

Answer

To increase security by blocking unknown traffic.

Question 6

When configuring a zone, what is the primary security benefit of selecting 'Enable User Identification'?

Accepted Answer

It allows the firewall to map IP addresses to usernames for policy enforcement.. Enabling User Identification on a zone allows the firewall to map source IP addresses to usernames (via User-ID agents, terminal services agents, or captive portal) so that security policies can be written based on users or groups rather than just IP addresses. This provides identity-based policy enforcement, which is the primary security benefit of the feature.

Answer

It protects the zone from SYN flood attacks.

Answer

It forces all traffic in the zone to be decrypted.

Answer

It automatically enables log forwarding to Panorama.

Question 7

An administrator is using the Strata Cloud Manager API to programmatically create a security rule. The API request fails with a 400 Bad Request error. The administrator has verified that the authentication token is valid and the endpoint URL is correct. Which of the following is the most likely cause of the error?

Accepted Answer

The API request is missing a required HTTP header, such as 'Content-Type: application/json'.. A 400 Bad Request error in the SCM API usually indicates a malformed request. Common causes include missing required HTTP headers like 'Content-Type: application/json', invalid JSON syntax, or missing required fields. Since the token and URL are correct, the administrator should inspect the request headers and body for compliance with the API specification.

Answer

The API endpoint URL is incorrect and points to a non-existent resource.

Answer

The security rule name contains special characters that are not allowed.

Answer

The API token has expired and needs to be refreshed.

Question 8

A security administrator needs to configure a Palo Alto Networks firewall to send logs to an external syslog server. The logs should include traffic, threat, and URL filtering data. Which type of profile should be configured to forward these logs?

Accepted Answer

Log Forwarding Profile. A Log Forwarding Profile is used to specify which logs are forwarded to external syslog servers. It matches on log types and attributes and references server profiles that contain the syslog server details. This is the correct configuration object to meet the requirement.

Answer

Security Policy Rule

Answer

Syslog Profile

Answer

Server Profile

Question 9

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Accepted Answer

The application signature does not match the traffic's port or pattern.. When creating a custom application object, the signature must correctly match the traffic's port and pattern. If the signature does not match the actual traffic characteristics (e.g., wrong port, incorrect pattern matching, or missing context), the firewall will not identify the application as the custom App-ID, and the Security Policy referencing that App-ID will not match, resulting in a deny.

Answer

The application must be assigned to the 'web' category.

Answer

The App-ID must be added to a service group.

Answer

The application requires an SSL decryption policy first.

Question 10

What is the purpose of the 'Zone Protection Profile'?

Accepted Answer

To defend against reconnaissance and floods at the zone ingress.. Zone Protection Profiles are used to defend against reconnaissance (e.g., port scans) and flood attacks (e.g., SYN, UDP, ICMP floods) at the zone ingress. They are applied to zones and provide protection before traffic reaches security policies.

Answer

To enforce SSL decryption on traffic within the zone.

Answer

To protect the management plane from web attacks.

Answer

To map IP addresses to user identities.