NetSec-Pro Connectivity And Security — 10 Questions

Question 1

A network engineer needs to monitor traffic between two zones using a specific interface. Which feature must be enabled to view application-level traffic details without affecting the traffic flow?

Accepted Answer

Enable Log Forwarding on the security policy.. Virtual Wire or tapping configurations allow traffic visibility, but within a routed environment, enabling App-ID and proper logging on security policies is the standard method for monitoring traffic details.

Answer

Disable the security policy.

Answer

Implement a Decryption Policy.

Answer

Create a mirror port on the switch.

Question 2

A firewall is experiencing high CPU usage on the management plane. Which command can identify if specific logging tasks are consuming excessive resources?

Accepted Answer

show system statistics. The 'debug software log-receiver' commands and 'show system statistics' are essential for checking management plane utilization by specific processes.

Answer

debug dataplane packet-diag

Answer

show running config

Answer

show session all

Question 3

Which tab in the Palo Alto Networks GUI displays the current session table?

Accepted Answer

Network > Runtime Stats > Session Browser. The 'Runtime Stats' section under 'Network' displays the active session table, which is essential for real-time monitoring of active flows.

Answer

Policies > Security

Answer

Device > Setup > Management

Answer

Monitor > Logs > Traffic

Question 4

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Accepted Answer

Decrease the MTU size on the tunnel interface.. Adjusting the MSS (Maximum Segment Size) or MTU on the tunnel interface helps avoid fragmentation issues caused by VPN headers, which are a common cause of packet loss in tunnels.

Answer

Increase the GlobalProtect timeout value.

Answer

Disable hardware offloading for IPv6.

Answer

Enable IPv6 transition mechanisms on the external interface.

Question 5

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Accepted Answer

Network > GlobalProtect > Gateways > Client Settings. In the GlobalProtect Gateway configuration, under the Client Settings, the IP pool or the use of an external DHCP server can be defined.

Answer

Objects > Addresses

Answer

Network > DHCP > Server

Answer

Device > Setup > Management

Question 6

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Accepted Answer

test security-policy-match source destination protocol . The 'test security-policy-match' command allows the administrator to simulate a packet flow against existing security policies to see which one matches or if it is dropped.

Answer

debug dataplane packet-diag

Answer

show running security-policy

Answer

show session all filter source <ip>

Question 7

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

Accepted Answer

System logs. System logs record infrastructure-level events, including BGP state changes and neighbor relationship transitions.

Answer

Traffic logs

Answer

Threat logs

Answer

Config logs

Question 8

When using OSPF with a Palo Alto Networks firewall, which area type would you configure to ensure the firewall does not receive external routing information while still maintaining connectivity to the backbone?

Accepted Answer

Totally Stubby Area. A Totally Stubby Area allows the firewall to reach the backbone via a default route while filtering out external and inter-area routes to save resources.

Answer

NSSA

Answer

Backbone Area (Area 0)

Answer

Standard Area

Question 9

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?

Accepted Answer

Add a static route in the Virtual Router pointing to the remote subnet using the tunnel interface as the next hop.. To route traffic into a VPN tunnel, the tunnel interface must be associated with a Virtual Router and have a static or dynamic route pointing to the remote subnet with the tunnel interface as the next hop.

Answer

Configure the tunnel interface in a separate security zone.

Answer

Change the tunnel interface type to Layer 3.

Answer

Enable Proxy-ID settings on the tunnel interface.

Question 10

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

Accepted Answer

Config Logs. Configuration logs (Config logs) explicitly track changes made to the firewall settings, including who made the change and when.

Answer

System Logs

Answer

Threat Logs

Answer

Traffic Logs