NetSec-Pro Practice Test 9 — 10 Questions

Question 1

A security administrator is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. They have enabled SSL Forward Proxy decryption on a security policy rule. However, users report that they are unable to access certain banking websites, and the firewall logs show decryption errors. Which action should the administrator take to resolve this issue while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the banking websites to the SSL Decryption Exclusion list.. SSL Decryption Exclusion is designed for sites that break when decrypted, such as those using certificate pinning. Banking websites commonly employ certificate pinning, causing clients to reject the firewall's certificate. Adding these sites to the exclusion list allows them to bypass decryption, restoring access while still decrypting and inspecting other traffic. Disabling decryption entirely or changing certificates/ciphers does not solve the specific compatibility issue.

Answer

Import the banking websites' certificates into the firewall's trust store.

Answer

Configure the firewall to use a different cipher suite for decryption.

Answer

Disable SSL Forward Proxy decryption entirely on the firewall.

Question 2

A security operations team is using the NetSec-Pro 'Policy Optimizer' to review rule usage. They notice that a rule allowing 'any' application on port 80 has a high session count but no application identification. They want to safely transition this rule to a more secure, application-based rule. Which action should they take first according to best practices?

Accepted Answer

Use the Policy Optimizer's 'App Usage' view to identify which applications are traversing the rule, then create a new rule with those applications.. Policy Optimizer's 'App Usage' view provides visibility into which applications are actually using a permissive rule. By analyzing this data, the administrator can create a new rule that allows only those specific applications, thus tightening security without guessing. This is a safe, data-driven approach recommended by best practices.

Answer

Clone the rule and set the clone to 'allow' with application 'any', then gradually phase out the original rule.

Answer

Enable 'Application' in the security policy and remove the 'any' application setting, then commit.

Answer

Change the rule's action to 'deny' and monitor logs for any blocked traffic to identify applications.

Question 3

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

Accepted Answer

Enable 'Sinkhole' and specify the IP address for the sinkhole.. Option A is correct because enabling the Sinkhole action in a DNS Security profile lets the firewall return a forged, administrator-specified IP address (the sinkhole IP) for DNS queries that match malicious domains, preventing clients from reaching malware command-and-control or payload servers. Option C is correct because the DNS Categories tab is where you select which URL/domain categories (e.g., malware, phishing, command-and-control) the profile should block or sinkhole, which is the core mechanism for filtering DNS-based threats. The other options do not belong: DNS over HTTPS (B) is a client-side encrypted transport that the firewall cannot simply 'force' via a DNS Security profile, a DNS Proxy object per zone (D) is not required for a DNS Security profile to function, and Packet Capture (E) is a troubleshooting/diagnostic feature, not a protection setting.

Answer

Configure 'DNS over HTTPS' to force all traffic through the firewall.

Answer

Create a 'DNS Proxy' object for every zone.

Answer

Enable 'Packet Capture' for all DNS traffic.

Question 4

An administrator managing 200 Palo Alto Networks firewalls with Strata Cloud Manager needs to rapidly deploy a new decryption policy only to firewalls in the European branch offices, which are identified by the region tag 'EU'. The administrator wants to avoid manual per-firewall configuration and ensure the policy is applied consistently. Which SCM feature should the administrator use?

Accepted Answer

Use a dynamic device group with a tag-based membership criterion filtering on 'EU'.. Dynamic device groups in Strata Cloud Manager allow policies to be applied based on tags, enabling automatic inclusion of firewalls matching the 'EU' region tag. This eliminates manual configuration, ensures consistency, and scales efficiently. Static groups require manual updates, source zones are not geographic, and Panorama template stacks address device settings rather than dynamic policy targeting.

Answer

Define a policy rule with a source zone of 'EU' and apply it globally.

Answer

Use a Panorama template stack with region-based variables.

Answer

Create a static device group and manually add each European firewall.

Question 5

An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?

Accepted Answer

Source NAT. Source NAT (SNAT) is correct because it translates the source IP address of outbound packets to a public IP address, allowing internal users with private IPs to access the internet while hiding their private addresses. This is the standard NAT type used for masquerading internal networks behind a single public IP or pool. It is typically implemented on the egress interface of a router or firewall, and is also known as IP masquerading or NAT overload (PAT).

Answer

Static NAT

Answer

Double NAT

Answer

Destination NAT

Question 6

Which THREE features are part of the Palo Alto Networks Single Pass Architecture?

Accepted Answer

App-ID. The Palo Alto Networks Single Pass Architecture performs all security processing in one pass through the dataplane, and its three core identifying technologies are App-ID, User-ID, and Content-ID. Option C (App-ID) is correct because it identifies the application regardless of port, protocol, or encryption, which is the foundation of the single-pass inspection. Option D (User-ID) is correct because it maps IP addresses to users and groups so policy can be enforced based on identity, feeding directly into the same single-pass evaluation. Option E (Content-ID) is correct because it applies threat prevention, URL filtering, file blocking, and data filtering to the identified flow within that same pass. Options A (Management interface) and B (Switching capacity) are not correct because they are platform/hardware characteristics rather than the security technologies that constitute the Single Pass Architecture.

Answer

Management interface

Answer

Switching capacity

Question 7

A network security engineer is troubleshooting a Security policy rule that is supposed to block traffic to a known malicious IP address. The rule is configured with the action 'deny' and is placed at the top of the rulebase. However, traffic to that IP is still being allowed. What is the most likely cause?

Accepted Answer

The malicious IP address is not correctly defined in the address object used in the rule.. The most likely cause is that the malicious IP address is not correctly defined in the address object used in the rule. If the address object is incorrect, the rule will not match traffic to that IP, and subsequent rules may allow it. Rule order and action are correct, and source zone 'any' does not prevent matching. Therefore, checking the address object is essential.

Answer

The rule is not matching because the source zone is set to 'any'.

Answer

The rule is being overridden by a more specific rule below it.

Answer

The rule action 'deny' is not supported; the correct action is 'drop'.

Question 8

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Accepted Answer

Vulnerability Protection. Vulnerability Protection is the security profile specifically designed to detect and block known exploit patterns, such as buffer overflows, SQL injection, and cross-site scripting, while allowing the traffic if it is not malicious. It inspects traffic for signatures of known vulnerabilities and can be configured to block or alert. For a web server, this profile is essential to protect against application-layer attacks.

Answer

Anti-Spyware

Answer

URL Filtering

Answer

File Blocking

Question 9

A network administrator is configuring a NetSec-Pro firewall to send alerts to an external email server when a critical threat is detected. They navigate to the 'Log Settings' under the 'Device' tab and configure the email server profile. Which additional step is required to ensure that threat logs trigger email notifications?

Accepted Answer

Create a log forwarding profile that includes email as a destination and attach it to the security policy.. To send email alerts for critical threats, the administrator must create a log forwarding profile that specifies email as a destination and apply it to the security policy. The email server profile provides the server details, but the log forwarding profile is what actually triggers the email based on matching logs.

Answer

Set the 'Log Severity' for threat logs to 'critical' in the global log settings.

Answer

Configure a syslog server profile and set the email server as the syslog destination.

Answer

Enable 'Email Notifications' in the 'Threat Prevention' profile settings.

Question 10

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

Accepted Answer

The Template Stack order is incorrectly configured, causing overlapping values.. A template conflict usually occurs when a setting is defined in both the Device-level configuration and the Panorama Template stack without proper stack ordering.

Answer

The Panorama license has expired.

Answer

The firewall is in maintenance mode.

Answer

The device group is locked by another administrator.