NetSec-Pro Practice Test 8 — 10 Questions

Question 1

A NetSec-Pro administrator is troubleshooting why a user cannot access a specific SaaS application. The security policy allows the application, but traffic is being denied. The administrator suspects that the application is being identified incorrectly. Which NetSec-Pro feature can be used to verify the application identification and take corrective action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Command Center (ACC). The Application Command Center (ACC) provides a centralized view of application usage and threat activity, including which applications are being identified. By using ACC, the administrator can confirm whether the SaaS application is correctly identified. If not, an Application Override policy can be applied to force the correct identification, resolving the access issue.

Answer

Session Browser

Answer

Application Override policy

Answer

Packet Capture

Question 2

When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?

Accepted Answer

Deny all traffic by default.. In a Zero Trust environment, the principle of least privilege is paramount. The default interzone policy should deny all traffic by default, and then explicit rules should be created to allow only necessary traffic based on identity, context, and other factors. This ensures that no traffic is implicitly trusted.

Answer

Allow all internal traffic, deny external.

Answer

Allow traffic based on source IP only.

Answer

Allow all traffic to simplify configuration.

Question 3

An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?

Accepted Answer

Through the scheduled 'Threats' dynamic update package.. The 'Threats' dynamic update package is the mechanism that delivers new and updated threat signatures (antivirus, anti-spyware, vulnerability protection) to the firewall. It is scheduled via Device > Dynamic Updates and can be set to download and install automatically. This package contains the signatures needed to detect and block zero-day exploits, as long as the firewall has a valid Threat Prevention license.

Answer

By manually downloading the threat signature database from the Customer Support Portal.

Answer

Through the daily WildFire update package.

Answer

By enabling the 'Automatic Update' feature in the Device > Software menu.

Question 4

You need to create a global address object that is available to all firewalls managed by Panorama. Where should you define this?

Accepted Answer

In the 'Shared' device group.. Shared objects are defined in the 'Shared' device group to make them available across all devices.

Answer

In the local firewall's Address tab.

Answer

In the root Template stack.

Answer

In the Policy Optimizer.

Question 5

A network administrator is configuring a Palo Alto Networks firewall and wants to ensure that security policy rules are evaluated in the correct order. They have created several rules with different source and destination zones. Which factor determines the order in which security policy rules are evaluated?

Accepted Answer

The rule's position in the security policy rulebase, from top to bottom.. Security policy rules are evaluated from top to bottom in the rulebase. The first rule that matches the traffic is enforced, and no further rules are checked. This sequential evaluation means that rule order directly affects security outcomes. Other factors such as creation time, priority values, or zone pairs do not influence evaluation order. Administrators must carefully order rules to achieve the desired allow or deny behavior.

Answer

The rule's priority value, which is set in the rule's advanced settings.

Answer

The rule's creation timestamp, with older rules evaluated first.

Answer

The rule's zone pair, with intra-zone rules evaluated before inter-zone rules.

Question 6

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?

Accepted Answer

The security policy is configured with the action 'Allow' but the profile setting is set to 'None'.. Security profiles are applied to traffic only if they are attached to the matching security policy rule. In the rule's Actions tab, the Profile Setting must be configured with a Security Profile Group or individual profiles. If it is left as 'None', the firewall allows the traffic but does not inspect it with any profiles. This is a common oversight when creating new rules.

Answer

The security policy is configured with a source and destination zone that do not match the traffic.

Answer

The security policy is using the 'Application Default' action instead of 'Allow'.

Answer

The security policy is set to 'Allow' but the 'Log at Session End' is disabled, which also disables security profile inspection.

Question 7

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

Accepted Answer

GlobalProtect App. The GlobalProtect App (B) is the endpoint client installed on mobile users' laptops and devices; it initiates the tunnel and enforces security policy on the endpoint, making it a core component of Prisma Access mobile user protection. The GlobalProtect Gateway (D) is the Prisma Access service infrastructure that terminates the GlobalProtect tunnels from mobile users and applies security policy in the cloud. The Identity Provider (E), using SAML or LDAP, is required to authenticate mobile users and enable identity-based policy enforcement before access is granted. Service Connection (A) is used to connect remote networks and data centers to Prisma Access, not mobile users, and a Local Branch Firewall (C) is a remote network component rather than part of the mobile user architecture.

Answer

Service Connection

Answer

Local Branch Firewall

Question 8

When using App-ID, what happens if traffic matches a policy allowing 'web-browsing' but the application is actually 'facebook-base'?

Accepted Answer

The traffic is dropped because it does not match the allowed application.. App-ID identifies the actual application, not just the port or protocol. If a policy allows 'web-browsing' but the traffic is identified as 'facebook-base', it does not match the allowed application. By default, the firewall denies traffic that does not match any rule, so the traffic is dropped. This enforces application-level control.

Answer

The traffic is allowed because Facebook uses HTTP.

Answer

The firewall allows it but flags the log as 'unknown'.

Answer

The firewall automatically updates the policy.

Question 9

Which action should be taken after performing a firmware upgrade on a Palo Alto Networks firewall to ensure all components are up to date?

Accepted Answer

Install the latest Dynamic Updates for App-ID and Threats.. After a firmware upgrade, the firewall's App-ID and Threat signatures may be outdated. Installing the latest Dynamic Updates ensures that the firewall has the most current application signatures and threat prevention capabilities, which are separate from the firmware itself.

Answer

Immediately reboot the device again.

Answer

Re-import the entire configuration XML file.

Answer

Factory reset the device.

Question 10

When configuring an interface for DHCP client, where do you set the default gateway?

Accepted Answer

The gateway is learned via the DHCP server response.. When an interface is configured as a DHCP client, the default gateway is not manually configured anywhere in the GUI — it is learned dynamically from the DHCP server's response (specifically the router option, DHCP option 3). The firewall installs this gateway into its virtual router's routing table automatically, so no static route or manual gateway entry is required. This is why the correct answer is that the gateway is learned via the DHCP server response.

Answer

Network > Interfaces > Advanced

Answer

Device > Setup > Services

Answer

Network > Virtual Router > Static Routes